CVE-2026-68318

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> pds_core: fix use-after-free on workqueue during remove<br /> <br /> In pdsc_remove(), the workqueue is destroyed before pdsc_teardown()<br /> is called. This ordering allows two paths to queue work on the<br /> destroyed workqueue:<br /> <br /> 1. If pdsc_teardown() -&gt; pdsc_devcmd_reset() times out, the error<br /> path in pdsc_devcmd_locked() queues health_work.<br /> <br /> 2. A NotifyQ event can trigger the ISR and queue work before free_irq()<br /> is called in pdsc_teardown().<br /> <br /> Fix by moving destroy_workqueue() after pdsc_teardown() so the<br /> workqueue outlives every queuer; destroy_workqueue() then flushes any<br /> work still pending.<br /> <br /> Draining the queued work also requires ordering the teardown so the<br /> resources that work touches are freed last:<br /> <br /> - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()<br /> the queue&amp;#39;s work and only then clear qcq-&gt;intx, so<br /> pdsc_process_adminq()&amp;#39;s read of qcq-&gt;intx for interrupt-credit<br /> return cannot race with the clear.<br /> <br /> - Free adminqcq before notifyqcq: the shared adminq ISR is released<br /> when adminqcq is freed, and the adminq work accesses notifyqcq, so<br /> both must be stopped before notifyqcq is freed.