Executive brief
A vulnerability in the Linux kernel's pds_core driver can lead to system instability or crashes. The issue occurs during firmware reset recoveries where the system fails to properly manage internal memory references, potentially leading to a resource leak or a kernel crash if debugging features are disabled. This primarily affects systems using specific AMD network acceleration hardware.
Technical details
A vulnerability exists in the pds_core driver within the Linux kernel's AMD Ethernet support (drivers/net/ethernet/amd/pds_core/debugfs.c). The function debugfs_lookup() returns a dentry with an elevated reference count that requires a corresponding dput() call; however, the driver was discarding this dentry without releasing the reference, causing a leak during every firmware reset recovery. Furthermore, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns an error pointer (ERR_PTR(-ENODEV)) rather than NULL. The driver's failure to validate this return value could result in dput() being called on an invalid pointer, leading to a kernel oops/crash. Patches have been released across multiple stable kernel branches to implement proper IS_ERR_OR_NULL checks and dput() calls.
Affected products
- Linux Linux 6.6.16 to 6.6.142, 6.7.4 to 6.8, 7.0.11, 7.1
Timeline
- 2026-05-15: other: Patch submitted by developer
- 2026-06-01: patched: Commits merged into stable trees
- 2026-07-19: advisory: CVE published and NVD record created
References
- https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c
- https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd
- https://git.kernel.org/stable/c/91d13e92b983e6c6d7631012c2e20ae8057de9f2
- https://git.kernel.org/stable/c/d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32
- https://git.kernel.org/stable/c/dc416e32baaeb620b9809e9e25fc7b30889686e9