CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pds_core: fix debugfs_lookup dentry leak and error handling debugfs_lookup() returns a dentry with an elevated reference count that must be released with dput(). The current code discards the returned dentry without calling dput(), causing a reference leak on every firmware reset recovery. Additionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV), not NULL. The current check passes for error pointers and would call dput() on an invalid pointer, causing a crash.

CVSS v3 5.5 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c	Patch
https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd	Patch
https://git.kernel.org/stable/c/91d13e92b983e6c6d7631012c2e20ae8057de9f2	Patch
https://git.kernel.org/stable/c/d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32	Patch
https://git.kernel.org/stable/c/dc416e32baaeb620b9809e9e25fc7b30889686e9	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.8:-::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc3::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc4::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc5::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc6::::::
	cpe:2.3:o:linux:linux_kernel:6.8:rc7::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::

History

No history.

Information

Published : 2026-07-19 16:17

Updated : 2026-08-17 19:37

NVD link : CVE-2026-64147

Mitre link : CVE-2026-64147

CVE.ORG link : CVE-2026-64147

JSON object : View

Products Affected

linux

linux_kernel

CWE

CWE-401

Missing Release of Memory after Effective Lifetime

{"id": "CVE-2026-64147", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2bbf2b1c20f934a054172175ccbabcc01fe69ef6", "lessThan": "60ef1675b652e912f3eb064767af4432393291fd", "versionType": "git"}, {"status": "affected", "version": "bc90fbe0c3182157d2be100a2f6c2edbb1820677", "lessThan": "26e19622c485e53c3fdb299e822068a0542ddf0c", "versionType": "git"}, {"status": "affected", "version": "bc90fbe0c3182157d2be100a2f6c2edbb1820677", "lessThan": "91d13e92b983e6c6d7631012c2e20ae8057de9f2", "versionType": "git"}, {"status": "affected", "version": "bc90fbe0c3182157d2be100a2f6c2edbb1820677", "lessThan": "d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32", "versionType": "git"}, {"status": "affected", "version": "bc90fbe0c3182157d2be100a2f6c2edbb1820677", "lessThan": "dc416e32baaeb620b9809e9e25fc7b30889686e9", "versionType": "git"}, {"status": "affected", "version": "3ffe14c36985e3174933127c9efad82ac8f3fefb", "versionType": "git"}, {"status": "affected", "version": "6.6.16", "lessThan": "6.6.142", "versionType": "semver"}, {"status": "affected", "version": "6.7.4", "lessThan": "6.8", "versionType": "semver"}], "programFiles": ["drivers/net/ethernet/amd/pds_core/debugfs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.8"}, {"status": "unaffected", "version": "0", "lessThan": "6.8", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.142", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.92", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/net/ethernet/amd/pds_core/debugfs.c"], "defaultStatus": "affected"}]}], "published": "2026-07-19T16:17:56.643", "references": [{"url": "https://git.kernel.org/stable/c/26e19622c485e53c3fdb299e822068a0542ddf0c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/60ef1675b652e912f3eb064767af4432393291fd", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/91d13e92b983e6c6d7631012c2e20ae8057de9f2", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d7f4dd4c8fb380898fef7a77d48fce7ccdb4fc32", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dc416e32baaeb620b9809e9e25fc7b30889686e9", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-401"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix debugfs_lookup dentry leak and error handling\n\ndebugfs_lookup() returns a dentry with an elevated reference count that\nmust be released with dput(). The current code discards the returned\ndentry without calling dput(), causing a reference leak on every\nfirmware reset recovery.\n\nAdditionally, when CONFIG_DEBUG_FS is disabled, debugfs_lookup()\nreturns ERR_PTR(-ENODEV), not NULL. The current check passes for error\npointers and would call dput() on an invalid pointer, causing a crash."}], "lastModified": "2026-08-17T19:37:15.583", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6891CB1E-CDF7-4C07-9E05-E49EACD17A61", "versionEndExcluding": "6.6.142", "versionStartIncluding": "6.6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "372F97C2-A80E-4F8A-9A04-3C21671C560F", "versionEndExcluding": "6.8", "versionStartIncluding": "6.7.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "627A848F-482C-4EB1-9D70-8D8D34144CF2", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.8.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:-:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "41E47F32-BA80-4333-96FD-4D25082B0FDD"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F02056A5-B362-4370-9FF8-6F0BD384D520"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "62075ACE-B2A0-4B16-829D-B3DA5AE5CC41"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A780F817-2A77-4130-A9B7-5C25606314E3"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AEB9199B-AB8F-4877-8964-E2BA95B5F15C"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.8:rc7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C9B8A5CE-6D20-4C36-AC01-ACA4B70003A8"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}