{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.6-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux-6.12"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.101-1~deb12u1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  pds_core: fix use-after-free on workqueue during remove  In pdsc_remove(), the workqueue is destroyed before pdsc_teardown() is called. This ordering allows two paths to queue work on the destroyed workqueue:  1. If pdsc_teardown() -\u003e pdsc_devcmd_reset() times out, the error    path in pdsc_devcmd_locked() queues health_work.  2. A NotifyQ event can trigger the ISR and queue work before free_irq()    is called in pdsc_teardown().  Fix by moving destroy_workqueue() after pdsc_teardown() so the workqueue outlives every queuer; destroy_workqueue() then flushes any work still pending.  Draining the queued work also requires ordering the teardown so the resources that work touches are freed last:    - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()     the queue's work and only then clear qcq-\u003eintx, so     pdsc_process_adminq()'s read of qcq-\u003eintx for interrupt-credit     return cannot race with the clear.    - Free adminqcq before notifyqcq: the shared adminq ISR is released     when adminqcq is freed, and the adminq work accesses notifyqcq, so     both must be stopped before notifyqcq is freed.",
  "id": "DEBIAN-CVE-2026-68318",
  "modified": "2026-09-14T16:47:38.944937887Z",
  "published": "2026-08-10T13:20:21.813Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-68318"
    }
  ],
  "upstream": [
    "CVE-2026-68318"
  ]
}