CVE-2026-68318

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the pds core component during the removal process. In the pdsc remove() function, the workqueue is destroyed before pdsc teardown() is executed. This sequence allows work to be queued on a destroyed workqueue through two potential paths: if pdsc teardown() leads to a timeout in pdsc devcmd reset(), the error path in pdsc devcmd locked() queues health work, or if a NotifyQ event triggers the Interrupt Service Routine (ISR) before free irq() is called in pdsc teardown(). Use-after-free occurs when the system attempts to access memory that has already been released.

Recommendations Update the Linux kernel to a version where the destroy workqueue() call is moved after pdsc teardown() to ensure the workqueue outlives all requesters. In pdsc qcq free(), ensure cancel work sync() is called after freeing the interrupt and before clearing qcq->intx to prevent races in pdsc process adminq(). Ensure adminqcq is freed before notifyqcq to ensure the shared adminq ISR is released and the adminq work is stopped before notifyqcq is freed.