{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "0861fccd43b8bafb533d97308862d20b7db3a2ad"
            },
            {
              "fixed": "646b58b543f3bb1641e9123b75ff7799fe7b42f1"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "f41e27b746241e57d968d1d61c008322338ca258"
            },
            {
              "fixed": "ef194751fed50cf3452017b63f00142a0ab40c70"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "b699bdc720c0255d1bb76cecba7382c1f2107af5"
            },
            {
              "fixed": "cf0ed2ba202f5c3b300ec1bf7ff0b5d555f7d518"
            },
            {
              "fixed": "bdeab32a7a91acd295d52a2d4ab1cc3f2da5e454"
            },
            {
              "fixed": "bfa33cd513c7ceb93c5a4c30e5662acd73c0a916"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "fec5f7af1d5f64a38f9224cd27b274d1af55a7ed"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.6.90"
            },
            {
              "fixed": "6.6.148"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.28"
            },
            {
              "fixed": "6.12.101"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.14.6"
            },
            {
              "fixed": "6.15"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.6.148"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.101"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.42"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.15.0"
            },
            {
              "fixed": "7.1.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68317.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\npds_core: fix auxiliary device add/del races\n\nTwo paths add or delete the same slot (pf-\u003evfs[vf_id].padev): a VF's\npdsc_reset_done() and the PF's devlink enable_vnet/disable_vnet handler.\nThey serialize on config_lock, but neither guards the slot under it\ncorrectly.\n\nadd() registers and stores a new auxiliary device without first checking\nthe slot, so a second add of an already-populated slot leaks the first\ndevice. del() makes that check outside config_lock, so two concurrent\ndels can both pass it; the first clears the slot, and the second\ndereferences a NULL pointer.\n\nCheck and update the slot under config_lock in both paths.",
  "id": "CVE-2026-68317",
  "modified": "2026-08-18T03:30:52.148897090Z",
  "published": "2026-08-10T12:02:52.185Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/646b58b543f3bb1641e9123b75ff7799fe7b42f1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bdeab32a7a91acd295d52a2d4ab1cc3f2da5e454"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bfa33cd513c7ceb93c5a4c30e5662acd73c0a916"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/cf0ed2ba202f5c3b300ec1bf7ff0b5d555f7d518"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ef194751fed50cf3452017b63f00142a0ab40c70"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/68xxx/CVE-2026-68317.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-68317"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "pds_core: fix auxiliary device add/del races"
}