CVE-2026-68318

pds_core: fix use-after-free on workqueue during remove

No scoreFix available

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Exploit likelihood

0.17%Unchanged since Aug 11, 2026

What each source reports

CVE List No score

pds_core: fix use-after-free on workqueue during remove

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: CVE-2026-68318
Updated: 2026-11-02

EUVDEUVD-2026-55419 No score

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: EUVD-2026-55419
Updated: 2026-11-02

GitHub AdvisoriesGHSA-q3gg-v595-rj52 No score

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix use-after-free...

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: GHSA-q3gg-v595-rj52
Updated: 2026-11-02

NVD No score

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: CVE-2026-68318
Updated: 2026-11-02

OSVAZL-94728 No score

CVE-2026-68318 affecting package kernel for versions less than 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: AZL-94728
Updated: 2026-11-07

OSV No score

pds_core: fix use-after-free on workqueue during remove

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:

If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work.
A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.

Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:

In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear.
Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: CVE-2026-68318
Updated: 2026-11-02

Show 13 moreShow less

OSVDEBIAN-CVE-2026-68318 No score

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix use-after-free on workqueue during remove In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue: 1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error path in pdsc_devcmd_locked() queues health_work. 2. A NotifyQ event can trigger the ISR and queue work before free_irq() is called in pdsc_teardown(). Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending. Draining the queued work also requires ordering the teardown so the resources that work touches are freed last: - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync() the queue's work and only then clear qcq->intx, so pdsc_process_adminq()'s read of qcq->intx for interrupt-credit return cannot race with the clear. - Free adminqcq before notifyqcq: the shared adminq ISR is released when adminqcq is freed, and the adminq work accesses notifyqcq, so both must be stopped before notifyqcq is freed.

Record: DEBIAN-CVE-2026-68318
Updated: 2026-11-02

OSVMGASA-2026-0336 No score

Updated kernel, kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages fix security vulnerabilities

Upstream kernel 6.18.44 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0336
Updated: 2026-11-02

OSVMGASA-2026-0337 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.44 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0337
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-68318 No score

Record: UBUNTU-CVE-2026-68318
Updated: 2026-11-10

OSVUSN-8887-1 No score

linux, linux-aws, linux-gcp, linux-gke, linux-ibm, linux-oracle, linux-realtime vulnerabilities

It was discovered that some AMD processors did not properly perform Reverse Map Table (RMP) checks when the IOMMU accessed certain host buffers. A local attacker with hypervisor access could possibly use this to trigger an out-of-bounds condition and compromise the integrity of SEV-SNP guest memory. (CVE-2023-20585)