dmaengine: idxd: fix double free of wq, engine, and group structs

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-80698
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-28 08:16:55 UTC
Updated2026-08-28 08:16:55 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release. In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.

Risk And Classification

EPSS: 0.001550000 probability, percentile 0.049960000 (date 2026-08-30)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c git Not specified
CNA Linux Linux affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c git Not specified
CNA Linux Linux affected 394e179f51fce06d6bb8ca5af8fa53f33c718cf4 git Not specified
CNA Linux Linux affected b09ad63775f58a8de3e228f59fb9543bfd964c9c git Not specified
CNA Linux Linux affected 26c219e7522c494f7865a928c81ced84cc7db3ae git Not specified
CNA Linux Linux affected 35ea8721d9e6e74c6847cf4d6c27e883b00b0331 git Not specified
CNA Linux Linux affected e6f86fe368cdc14764833a6e8bb59f7a85a40e06 git Not specified
CNA Linux Linux affected 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886 git Not specified
CNA Linux Linux affected 5.11.22 5.12 semver Not specified
CNA Linux Linux affected 5.12.5 5.13 semver Not specified
CNA Linux Linux affected 5.13 Not specified
CNA Linux Linux unaffected 5.13 semver Not specified
CNA Linux Linux unaffected 7.1.8 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report