---
id: CVE-2026-98020
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pds_core: fix cmd_regs access racing BAR unmap on reset

  pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
  clear/iounmap cmd_regs without devcmd_l…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pds_core: fix cmd_regs access racing BAR unmap on reset

  pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
  clear/iounmap cmd_regs without devcmd_l…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    2cc697565fd19b5ba2d100cdd4a20dd6d263abc2
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    fa31bd14c5042c6315bb2182c963f03ca6e79ca4
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    09f831bfe39de5b8026fefb3d106b5cc93272170
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    7980325b2f71e3f65c1323c39792e2455da6fab6
  - Linux f6ec6ac9432941ec85a2221c91b1ecfc85680d89
  - Linux 692488941283d72362274620b9abd28109fc459f
  - Linux >= 6.6.16 < 6.7
  - Linux >= 6.7.4 < 6.8
  - Linux 6.8
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T11:17:30.480'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98020'
references:
  - url: 'https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7980325b2f71e3f65c1323c39792e2455da6fab6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fa31bd14c5042c6315bb2182c963f03ca6e79ca4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.856Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix cmd_regs access racing BAR unmap on reset

pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
clear/iounmap cmd_regs without devcmd_lock, and
pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after
dropping and retaking the lock without re-checking. An FLR concurrent
with a devlink flash can unmap cmd_regs under an in-flight devcmd,
causing a NULL deref or a write to unmapped MMIO.

Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in
the download loop. Only the PF maps cmd_regs and runs devcmd, so skip
the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.

A reset that completes entirely within the unlocked window is not a
correctness problem for the image: the device clears its update session,
so a resumed download is rejected, and it verifies the staged image
before writing a flash slot, reporting PDS_RC_BAD_FW rather than
activating it.

pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The
interrupt and start/stop readers of those are quiesced before the unmap
by pdsc_fw_down(), which frees the interrupts and tears down the queues.
The debugfs readers are not, since those files outlive a reset; that is
pre-existing and out of scope here.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.