From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32171279329 for ; Sun, 19 Jul 2026 15:46:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475963; cv=none; b=R9ZZN57xONWrWGzesKxqJ5qRYwMGZ3QqQv18X8jRex0TuHxr/ZApF3W07eteQ8om5QzRrsmrEdjAwKVg2XaschvlPH7Gd4hObnu2YbcEQ3pqj373XiZhE7OPPJ+nQLxdp5JHVQkyADg107WsfPlDxxsda1Kf/OZEuQajXkk3aJ8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784475963; c=relaxed/simple; bh=hNnRsMkKznDh9RjPcoPu407mNi7oQK3j/V18cviMn0w=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GbKqB3Sl4ayKL7jqroblAMpG1KECIx/xpCzTPrz7SdAg9cA/15bWRS8+idSsp1vYW/UdQEyXWeVx0RNJkV9QLOoXSgkEX6ZIl42RyTiE+/7fa8JHvBNIXBniESqO9sC0J1K1NQBE5tWnyR3Q3R6LV4CwjfXK0BWvD/rmzjwwm1c= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=HXGuwQxc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="HXGuwQxc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 527451F000E9; Sun, 19 Jul 2026 15:46:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784475962; bh=bpCI0FNbgJ44TMR5Ae81I/tyasNak9Rvo2qJ6x7tTF8=; h=From:To:Cc:Subject:Date:Reply-To; b=HXGuwQxcDo1jUYStPX65CMz1gQArPI65ZZXgDkor1+4Rw2PtXcscbU543NH85IURT oruVy1FoEsJm6bbGrqdiOXpu4LTyVLUVVuf5wINM91iFTOAKV/MW1wlFJ5Id4cSsGU +SsRiAkTt5cpa3bFxVjsQ81n+KK/7BlBGKGLZPg8= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64147: pds_core: fix debugfs_lookup dentry leak and error handling Date: Sun, 19 Jul 2026 17:40:09 +0200 Message-ID: <2026071930-CVE-2026-64147-ffb3@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2996; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=WYFhWI0kuGqTnNBJHY+etvjHoomyBgJ4QqDcKZYF4+U=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkx78u6f3Hof+MQbdvNbVV4v0N/bTdnJ7PXEpUbv1iu6 1xdpXCtI5aFQZCJQVZMkeXLNp6j+ysOKXoZ2p6GmcPKBDKEgYtTACbi8YhhfvSVs7lCiQsYLztY mE1h9dGZNM9jB8OCaUdsrL9we1/c+ml5xkmNac/vLpa4CQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash. The Linux kernel CVE team has assigned CVE-2026-64147 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.16 with commit 2bbf2b1c20f934a054172175ccbabcc01fe69ef6 and fixed in 6.6.142 with commit 60ef1675b652e912f3eb064767af4432393291fd Issue introduced in 6.8 with commit bc90fbe0c3182157d2be100a2f6c2edbb1820677 and fixed in 6.12.92 with commit 26e19622c485e53c3fdb299e822068a0542ddf0c Issue introduced in 6.8 with commit bc90fbe0c3182157d2be100a2f6c2edbb1820677 and fixed in 6.18.34 with commit 91d13e92b983e6c6d7631012c2e20ae8057de9f2 Issue introduced in 6.8 with commit bc90fbe0c3182157d2be100a2f6c2edbb1820677 and fixed in 7.0.11 with commit d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32 Issue introduced in 6.8 with commit bc90fbe0c3182157d2be100a2f6c2edbb1820677 and fixed in 7.1 with commit dc416e32baaeb620b9809e9e25fc7b30889686e9 Issue introduced in 6.7.4 with commit 3ffe14c36985e3174933127c9efad82ac8f3fefb Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64147 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/net/ethernet/amd/pds_core/debugfs.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c https://git.kernel.org/stable/c/91d13e92b983e6c6d7631012c2e20ae8057de9f2 https://git.kernel.org/stable/c/d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32 https://git.kernel.org/stable/c/dc416e32baaeb620b9809e9e25fc7b30889686e9