CVE-2026-68318

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown()

is called. This ordering allows two paths to queue work on the

destroyed workqueue:

1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error

path in pdsc_devcmd_locked() queues health_work.

2. A NotifyQ event can trigger the ISR and queue work before free_irq()

is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the

workqueue outlives every queuer; destroy_workqueue() then flushes any

work still pending.

Draining the queued work also requires ordering the teardown so the

resources that work touches are freed last:

- In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()

the queue's work and only then clear qcq->intx, so

pdsc_process_adminq()'s read of qcq->intx for interrupt-credit

return cannot race with the cle

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References