# CVE-2026-98020: Linux kernel pds_core race condition in cmd_regs BAR access during reset

Source: https://junglewise.ai/threats/cve-2026-98020-in-the-linux-kernel-the-following-vulnerability-has-been-resolved  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-98020 · Severity: info · Published 2026-09-25

The pds_core driver in the Linux kernel contains a race condition where firmware reset operations can unmap memory-mapped I/O registers while firmware update operations are still accessing them. This can cause the system to crash with a null pointer dereference or write to invalid memory addresses. An attacker with ability to trigger both a device reset and firmware update concurrently could crash the system or potentially cause memory corruption.

Technologies: [Unknown Linux kernel](https://junglewise.ai/threats/technologies/unknown-linux-kernel). Vendors: [Unknown](https://junglewise.ai/threats/vendors/unknown).

## Quick answers

**Is CVE-2026-98020 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-98020 being exploited in the wild.

**How severe is CVE-2026-98020?** Informational severity, published 25 September 2026.

**Which products and versions are affected?** Unknown Linux kernel Affected versions prior to fix commit 7980325b2f71e3f65c1323c39792e2455da6fab6 in pds_core driver.

**Is there a fix for CVE-2026-98020?** A patch was published on 2026-09-21. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-98020 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-98020?** Check whether you run Unknown Linux kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists between pdsc_reset_prepare() and pdsc_firmware_update() in the pds_core driver. The reset path unmaps BAR registers (cmd_regs) without holding the devcmd_lock, while the firmware download loop can release and re-acquire the lock without re-checking if cmd_regs remains mapped, allowing an FLR (Function Level Reset) to unmap cmd_regs during active devcmd operations. The fix adds proper locking around BAR unmap/remap operations and adds cmd_regs validity checks after lock re-acquisition in the firmware update loop.

## Affected products

- <UNKNOWN> Linux kernel Affected versions prior to fix commit 7980325b2f71e3f65c1323c39792e2455da6fab6 in pds_core driver

## Timeline

- 2026-09-25: disclosed
- 2026-09-21: patched

## References

- [https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170](https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170)
- [https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2](https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2)

## Related threats

- [Linux kernel netfilter nft_byteorder multi-register bypass](https://junglewise.ai/threats/cve-2026-99285-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel GPIO null pointer dereference in shared GPIO lookup](https://junglewise.ai/threats/cve-2026-99257-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel NTFS race condition in page fault handler](https://junglewise.ai/threats/cve-2026-99241-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel i915 DMC firmware load address validation bypass](https://junglewise.ai/threats/cve-2026-99146-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel dm-integrity buffer overflow in inline mode](https://junglewise.ai/threats/cve-2026-99098-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)