SB20260812216 - Use-after-free in Linux kernel amd pds_core driver

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-68318)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in the pds_core driver workqueue handling during device removal and teardown when processing queued work and interrupt-driven events. A local user can trigger device removal or teardown activity to cause a denial of service.

The issue can be reached when queued work is scheduled after the workqueue has been destroyed, including timeout handling in device command reset and NotifyQ interrupt activity before the interrupt handler is freed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327
• https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75
• https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5
• https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156