CVE-2026-68318 Overview
CVE-2026-68318 is a use-after-free vulnerability in the Linux kernel's pds_core driver. The flaw resides in the pdsc_remove() function, where the workqueue is destroyed before pdsc_teardown() executes. This ordering allows two code paths to queue work on the already-destroyed workqueue, resulting in memory corruption. The upstream fix reorders teardown so the workqueue outlives all queuers and drains pending work safely.
Critical Impact
A use-after-free during device removal can corrupt kernel memory, cause kernel panics, or provide primitives for privilege escalation on systems using the Pensando Distributed Services (PDS) core driver.
Affected Products
- Linux kernel builds including the pds_core driver
- Systems using Pensando Distributed Services (PDS) devices
- Distributions shipping kernels prior to the fix commits referenced below
Discovery Timeline
- 2026-08-10 - CVE-2026-68318 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68318
Vulnerability Analysis
The pds_core driver manages Pensando Distributed Services devices in the Linux kernel. During device removal, pdsc_remove() invokes destroy_workqueue() before calling pdsc_teardown(). Two independent paths can still enqueue work after the workqueue is gone.
First, when pdsc_teardown() calls pdsc_devcmd_reset() and the reset times out, the error path in pdsc_devcmd_locked() queues health_work onto the destroyed workqueue. Second, a NotifyQ event can trigger the interrupt service routine (ISR) and queue work before free_irq() is called during teardown. Both cases dereference freed workqueue memory.
Root Cause
The root cause is an ordering bug in resource lifetime management [CWE-416]. The teardown sequence releases the workqueue while producers of work items are still active. Adminq work also accesses notifyqcq, and the shared adminq ISR is released only when adminqcq is freed, creating additional lifetime dependencies that the original code did not honor.
Attack Vector
Exploitation requires the local system to trigger device removal or a NotifyQ event during teardown on hardware that binds to pds_core. The vulnerability manifests during driver unload, hot-unplug, or reset timeout conditions. The fix moves destroy_workqueue() after pdsc_teardown(), calls cancel_work_sync() in pdsc_qcq_free() before clearing qcq->intx, and frees adminqcq before notifyqcq so shared resources remain valid until every producer has stopped.
Detection Methods for CVE-2026-68318
Indicators of Compromise
- Kernel panics or oops entries referencing pds_core, pdsc_remove, pdsc_teardown, or pdsc_process_adminq in dmesg or /var/log/kern.log
- KASAN use-after-free reports naming workqueue functions during device unbind or module removal
- Unexpected driver reset timeouts followed by health_work scheduling errors
Detection Strategies
- Inventory kernel versions across Linux hosts and compare against the fixed commits 0ad1348, 224214e, 9e0f80f, and ecc7a7d referenced in kernel.org
- Enable KASAN in test environments to surface use-after-free conditions during pds_core unload cycles
- Monitor for repeated ISR or NotifyQ activity coinciding with rmmod pds_core or PCI hot-unplug operations
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on pds_core fault signatures
- Track module load and unload events with auditd rules on kernel modules
- Correlate hardware events from Pensando devices with system stability metrics to identify latent instability
How to Mitigate CVE-2026-68318
Immediate Actions Required
- Identify all hosts running kernels with the pds_core driver enabled and Pensando hardware attached
- Apply the upstream Linux kernel patches referenced by the fix commits or update to a distribution kernel that includes them
- Avoid unbinding, unloading, or hot-removing pds_core on unpatched systems until the fix is in place
Patch Information
The fix is present in the following upstream commits: Kernel Git Commit 0ad1348, Kernel Git Commit 224214e, Kernel Git Commit 9e0f80f, and Kernel Git Commit ecc7a7d. The patches move destroy_workqueue() after pdsc_teardown(), add cancel_work_sync() in pdsc_qcq_free(), and reorder freeing of adminqcq and notifyqcq.
Workarounds
- Blacklist the pds_core module on systems that do not require Pensando device support until patches are applied
- Restrict local access and administrative privileges required to unload kernel modules
- Schedule maintenance so device removal or driver reload operations occur only after the fixed kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
