CVE-2026-68317: Linux Kernel Race Condition Vulnerability

CVE-2026-68317 Overview

CVE-2026-68317 is a race condition vulnerability in the Linux kernel pds_core driver. The flaw affects auxiliary device add and delete operations for the Pensando Distributed Services (PDS) core driver. Two code paths manipulate the same slot (pf->vfs[vf_id].padev): a Virtual Function's (VF) pdsc_reset_done() and the Physical Function's (PF) devlink enable_vnet/disable_vnet handler. While both paths acquire config_lock, neither correctly guards the slot access under it. The Linux kernel maintainers have resolved this vulnerability through multiple stable branch commits.

Critical Impact
Concurrent invocations of the add/delete paths can leak an auxiliary device or trigger a NULL pointer dereference, resulting in a kernel crash.

Affected Products

Linux kernel pds_core driver
Systems using Pensando Distributed Services (PDS) auxiliary devices
SR-IOV enabled configurations with pds_core VFs

Discovery Timeline

2026-08-10 - CVE-2026-68317 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68317

Vulnerability Analysis

The vulnerability resides in the pds_core driver, which manages auxiliary devices representing virtual functions in Pensando hardware. Two concurrent execution paths can modify the same slot in the pf->vfs[vf_id].padev array. The first path is the VF's pdsc_reset_done() handler, which reinitializes the auxiliary device after a reset. The second path is the PF's devlink enable_vnet/disable_vnet operation, which enables or disables the VNet functionality. Both paths were designed to serialize on config_lock, but the critical slot checks and updates occur outside the lock's protection.

Root Cause

The add() function registers and stores a new auxiliary device without first verifying whether the slot is already populated. When two add operations execute concurrently on the same slot, the first auxiliary device pointer is overwritten and leaked. The del() function checks whether the slot is populated outside the config_lock critical section. Two concurrent delete operations can both pass the check simultaneously. The first delete clears the slot, and the second dereferences a NULL pointer. This classifies the flaw as a race condition, specifically a Time-of-Check to Time-of-Use (TOCTOU) issue.

Attack Vector

Exploitation requires local privileges to trigger the affected devlink operations or VF reset events. A local user with sufficient permissions can invoke concurrent enable/disable operations on the auxiliary device, or trigger a VF reset while a devlink operation is in flight. The resulting NULL pointer dereference produces a kernel oops, causing denial of service. The device leak path may consume kernel resources over time. The patched code moves both the slot check and update inside config_lock, ensuring atomic verification and modification of the slot state. Refer to the Linux Kernel Commit bfa33cd5 and related stable backports for the specific implementation of the fix.

Detection Methods for CVE-2026-68317

Indicators of Compromise

Kernel oops or panic messages referencing pds_core, pdsc_reset_done, or auxiliary device functions in dmesg or system logs.
Unexpected NULL pointer dereference stack traces involving pf->vfs or padev symbols.
Repeated devlink enable_vnet/disable_vnet operations correlated with VF reset events.

Detection Strategies

Monitor kernel logs for stack traces containing pdsc_ prefixed function names and NULL dereference oops signatures.
Audit installed kernel versions against the fixed commits listed in the kernel.org stable tree.
Correlate SR-IOV VF reset events with concurrent devlink management operations in host telemetry.

Monitoring Recommendations

Forward kernel ring buffer and journald logs to a centralized SIEM for correlation of crash signatures across fleets.
Track pds_core module load events and driver version strings on hosts running Pensando hardware.
Alert on unexpected VF reset frequency, which may indicate attempts to trigger the race window.

How to Mitigate CVE-2026-68317

Immediate Actions Required

Inventory all hosts running the Linux kernel pds_core driver, particularly systems using Pensando DSC hardware with SR-IOV enabled.
Apply the patched kernel from your distribution vendor incorporating the upstream fixes.
Restrict CAP_NET_ADMIN and devlink management access to trusted administrators only.

Patch Information

The fix ensures that both the slot check and slot update occur under config_lock in the add() and del() paths. The upstream fix is present in the following stable branch commits: Linux Kernel Commit 646b58b, Linux Kernel Commit bdeab32a, Linux Kernel Commit bfa33cd5, Linux Kernel Commit cf0ed2ba, and Linux Kernel Commit ef194751. Consult your Linux distribution's security advisories to identify the corresponding backported kernel package.

Workarounds

Disable SR-IOV on affected Pensando devices if virtual functions are not required in the environment.
Avoid concurrent devlink enable_vnet/disable_vnet operations while VF reset events may be in progress.
Unload the pds_core module on hosts that do not require Pensando functionality until a patched kernel is deployed.

bash

# Verify running kernel version and pds_core module status
uname -r
lsmod | grep pds_core
modinfo pds_core | grep -E 'version|filename'

# Optionally unload the module if not required
sudo rmmod pds_core