CVE-2026-68318: pds_core: fix use-after-free on workqueue during remove

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

pds_core: fix use-after-free on workqueue during remove

In pdsc_remove(), the workqueue is destroyed before pdsc_teardown()
is called. This ordering allows two paths to queue work on the
destroyed workqueue:

1. If pdsc_teardown() -> pdsc_devcmd_reset() times out, the error
   path in pdsc_devcmd_locked() queues health_work.

2. A NotifyQ event can trigger the ISR and queue work before free_irq()
   is called in pdsc_teardown().

Fix by moving destroy_workqueue() after pdsc_teardown() so the
workqueue outlives every queuer; destroy_workqueue() then flushes any
work still pending.

Draining the queued work also requires ordering the teardown so the
resources that work touches are freed last:

  - In pdsc_qcq_free(), after freeing the interrupt, cancel_work_sync()
    the queue's work and only then clear qcq->intx, so
    pdsc_process_adminq()'s read of qcq->intx for interrupt-credit
    return cannot race with the clear.

  - Free adminqcq before notifyqcq: the shared adminq ISR is released
    when adminqcq is freed, and the adminq work accesses notifyqcq, so
    both must be stopped before notifyqcq is freed.

The Linux kernel CVE team has assigned CVE-2026-68318 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit 01ba61b55b2041a39c54aefb3153c770dd59a0ef and fixed in 6.12.101 with commit 224214eb4182ff20a665b615a90b66017539dd75
	Issue introduced in 6.4 with commit 01ba61b55b2041a39c54aefb3153c770dd59a0ef and fixed in 6.18.42 with commit 9e0f80fac50ab95dd75537c8ecaf5051d01f19b5
	Issue introduced in 6.4 with commit 01ba61b55b2041a39c54aefb3153c770dd59a0ef and fixed in 7.1.6 with commit ecc7a7d7569ec1d6a61e18372696b9de97635156
	Issue introduced in 6.4 with commit 01ba61b55b2041a39c54aefb3153c770dd59a0ef and fixed in 7.2-rc5 with commit 0ad134881508c36b65c1a8864f8bec53adbd3327

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-68318
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/amd/pds_core/core.c
	drivers/net/ethernet/amd/pds_core/main.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/224214eb4182ff20a665b615a90b66017539dd75
	https://git.kernel.org/stable/c/9e0f80fac50ab95dd75537c8ecaf5051d01f19b5
	https://git.kernel.org/stable/c/ecc7a7d7569ec1d6a61e18372696b9de97635156
	https://git.kernel.org/stable/c/0ad134881508c36b65c1a8864f8bec53adbd3327