AUGUST 22, 2026
Live Feed
Back to database
Case File

CVE-2026-68319

UNKNOWN · CVSS N/A EPSS 0.17%

Source: NVD + CISA KEV + EPSS · Published 2026-08-10 · Last synced 2026-08-22

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's handling of PCI device resets, specifically a deadlock scenario that can occur between the reset thread and the device removal process. This deadlock can lead to system hangs, impacting the stability and availability of systems relying on PCI devices. Organizations using Linux-based systems, particularly those with critical applications that involve PCI devices, should prioritize applying the fix to mitigate potential disruptions.

CVE
CVE-2026-68319
Severity
UNKNOWN
CVSS
N/A
EPSS
0.17%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix deadlock between reset thread and remove pci_reset_function() acquires device_lock before performing the reset. pdsc_remove() is called by the PCI core with device_lock already held. If pdsc_pci_reset_thread() is running when pdsc_remove() is called, destroy_workqueue() will block waiting for the work to complete, while the work is blocked waiting for device_lock - deadlock. Use pci_try_reset_function() which uses pci_dev_trylock() internally. This acquires both the device lock and the PCI config access lock without blocking - if either lock is contended, it returns -EAGAIN immediately. This avoids the deadlock while also ensuring proper config space access serialization during the reset. The pci_dev_get/put calls are also removed as they were unnecessary - the driver-owned workqueue is destroyed in pdsc_remove(), guaranteeing the work completes before remove returns. The PCI core holds its reference to pci_dev throughout the entire unbind sequence.