In the Linux kernel’s PDS core, a race condition exists between the reset logic and a concurrent devlink flash operation. During a reset sequence, the driver unmaps the BAR that contains cmd_regs without holding the devcmd_lock. If an FLR (Functional Level Reset) occurs at the same time as a devlink flash, cmd_regs can be unmapped while an in‑flight devcmd still references it. This can lead to a NULL dereference or a write to an unmapped MMIO region, potentially causing a kernel crash or memory corruption. The flaw makes the kernel vulnerable to corruption of the device firmware image during an update cycle, which could compromise the integrity of the system.

The vulnerability affects the Linux kernel, specifically the pds_core module that manages private device services. Both vendor listings identified as Linux:Linux point to the generic upstream kernel. No specific kernel version range is supplied, so all kernel releases that compile the affected module before the fix are potentially exposed. The list of affected products includes any deployment that uses the current upstream kernel or derivatives that have not yet applied the upstream fix.

The CVSS score is 5.5, and the EPSS score is < 1%, which limits quantitative risk assessment. Based on the EPSS score and KEV status, it is inferred that the vulnerability is not currently widely exploited. However, the issue is a race condition that requires privileged code paths to trigger and is only exploitable during firmware update or reset operations. The lack of public exploitation and the fact that the problem is limited to internal driver logic suggest a moderate to high risk for environments that regularly perform device firmware updates. The vulnerability is not listed in CISA’s KEV catalog, implying that, as of now, there are no known widespread attacks. Attackers would need to orchestrate a coordinated reset and flash operation, which is unlikely to be initiated by an attacker without root or kernel module access.