---
id: CVE-2026-98020
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pds_core: fix cmd_regs access racing BAR unmap on reset

  pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
  clear/iounmap cmd_regs without devcmd_l…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pds_core: fix cmd_regs access racing BAR unmap on reset

  pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
  clear/iounmap cmd_regs without devcmd_l…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f6ec6ac9432941ec85a2221c91b1ecfc85680d89 <
    0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    2cc697565fd19b5ba2d100cdd4a20dd6d263abc2
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    fa31bd14c5042c6315bb2182c963f03ca6e79ca4
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    09f831bfe39de5b8026fefb3d106b5cc93272170
  - >-
    Linux >= e96094c1d11cce4deb5da3c0500d49041ab845b8 <
    7980325b2f71e3f65c1323c39792e2455da6fab6
  - Linux 692488941283d72362274620b9abd28109fc459f
  - Linux >= 6.6.16 < 6.6.158
  - Linux >= 6.7.4 < 6.8
  - Linux 6.8
published: '2026-09-25'
updated: '2026-10-03'
sourceUpdated: '2026-10-03T11:18:25.030'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98020'
references:
  - url: 'https://git.kernel.org/stable/c/09f831bfe39de5b8026fefb3d106b5cc93272170'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/0bf9f3bae3c4b1eadb7a2bf63350333db7dac0d9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/2cc697565fd19b5ba2d100cdd4a20dd6d263abc2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7980325b2f71e3f65c1323c39792e2455da6fab6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fa31bd14c5042c6315bb2182c963f03ca6e79ca4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98020.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98020'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2541059'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98020'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98020'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98020.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00168
epssPercentile: 0.06041
cvssSource: vendor
ingestedAt: '2026-09-25T11:06:38.856Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix cmd_regs access racing BAR unmap on reset

pdsc_reset_prepare() and pdsc_reset_done()'s pdsc_map_bars() error path
clear/iounmap cmd_regs without devcmd_lock, and
pdsc_legacy_firmware_update()'s download loop derefs cmd_regs after
dropping and retaking the lock without re-checking. An FLR concurrent
with a devlink flash can unmap cmd_regs under an in-flight devcmd,
causing a NULL deref or a write to unmapped MMIO.

Take devcmd_lock across the BAR unmap/remap, and re-check cmd_regs in
the download loop. Only the PF maps cmd_regs and runs devcmd, so skip
the unmap on a VF, as pdsc_remove() and pdsc_reset_done() already do.

A reset that completes entirely within the unlocked window is not a
correctness problem for the image: the device clears its update session,
so a resumed download is rejected, and it verifies the staged image
before writing a flash slot, reporting PDS_RC_BAD_FW rather than
activating it.

pdsc_unmap_bars() also clears info_regs, intr_status and intr_ctrl. The
interrupt and start/stop readers of those are quiesced before the unmap
by pdsc_fw_down(), which frees the interrupts and tears down the queues.
The debugfs readers are not, since those files outlive a reset; that is
pre-existing and out of scope here.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-28 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98020.json)