pds_core: fix cmd_regs access racing BAR unmap on reset
Summary
| CVE | CVE-2026-98020 |
|---|
| State | PUBLISHED |
|---|
| Assigner | Linux |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2026-09-25 11:17:30 UTC |
|---|
| Updated | 2026-09-25 11:17:30 UTC |
|---|
| Description | In the Linux kernel, the following vulnerability has been resolved:
pds_core: fix cmd_regs access racing BAR unmap on reset
pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
clear/iounmap cmd_regs without devcmd_lock, and
pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after
dropping and retaking the lock without re-checking. An FLR concurrent
with a devlink flash can unmap cmd_regs under an in-flight devcmd,
causing a NULL deref or a write to unmapped MMIO.
Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in
the download loop. Only the PF maps cmd_regs and runs devcmd, so skip
the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.
A reset that completes entirely within the unlocked window is not a
correctness problem for the image: the device clears its update session,
so a resumed download is rejected, and it verifies the staged image
before writing a flash slot, reporting PDS_RC_BAD_FW rather than
activating it.
pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The
interrupt and start/stop readers of those are quiesced before the unmap
by pdsc_fw_down(), which frees the interrupts and tears down the queues.
The debugfs readers are not, since those files outlive a reset; that is
pre-existing and out of scope here. |
|---|
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|
| CNA |
Linux |
Linux |
affected e96094c1d11cce4deb5da3c0500d49041ab845b8 2cc697565fd19b5ba2d100cdd4a20dd6d263abc2 git |
Not specified |
| CNA |
Linux |
Linux |
affected e96094c1d11cce4deb5da3c0500d49041ab845b8 fa31bd14c5042c6315bb2182c963f03ca6e79ca4 git |
Not specified |
| CNA |
Linux |
Linux |
affected e96094c1d11cce4deb5da3c0500d49041ab845b8 09f831bfe39de5b8026fefb3d106b5cc93272170 git |
Not specified |
| CNA |
Linux |
Linux |
affected e96094c1d11cce4deb5da3c0500d49041ab845b8 7980325b2f71e3f65c1323c39792e2455da6fab6 git |
Not specified |
| CNA |
Linux |
Linux |
affected f6ec6ac9432941ec85a2221c91b1ecfc85680d89 git |
Not specified |
| CNA |
Linux |
Linux |
affected 692488941283d72362274620b9abd28109fc459f git |
Not specified |
| CNA |
Linux |
Linux |
affected 6.6.16 6.7 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.7.4 6.8 semver |
Not specified |
| CNA |
Linux |
Linux |
affected 6.8 |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.8 semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.12.111 6.12.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 6.18.53 6.18.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.2.7 7.2.* semver |
Not specified |
| CNA |
Linux |
Linux |
unaffected 7.3-rc3 * original_commit_for_fix |
Not specified |
References
| Reference | Source | Link | Tags |
|---|
| git.kernel.org/stable/c/7980325b2f71e3f65c1323c39792e2455da6fab6 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/fa31bd14c5042c6315bb2182c963f03ca6e79ca4 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2 |
416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
git.kernel.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.