{"api_version":"1","generated_at":"2026-09-01T04:19:01+00:00","cve":"CVE-2026-80698","urls":{"html":"https://cve.report/CVE-2026-80698","api":"https://cve.report/api/cve/CVE-2026-80698.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-80698","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-80698"},"summary":{"title":"dmaengine: idxd: fix double free of wq, engine, and group structs","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix double free of wq, engine, and group structs\n\nThe release callbacks for wq, engine, and group devices\n(idxd_conf_wq_release, idxd_conf_engine_release,\nidxd_conf_group_release) each call kfree() on the enclosing struct.\nThe setup error paths and cleanup functions also call kfree()\nexplicitly after put_device(), producing a double free whenever\nput_device() drops the reference count to zero and fires the release.\n\nIn the setup functions, device_initialize() is called before\ndevice_add(), so the reference count is exactly 1 at the error sites.\nput_device() unconditionally fires the release, which frees the struct;\nthe subsequent explicit kfree() then operates on freed memory.\n\nFor idxd_setup_wqs(), the wq release callback also owns opcap_bmap\nand wqcfg. The error unwind additionally freed those fields explicitly\nbefore calling put_device(), causing further double frees on both.\n\nRemove the redundant explicit kfree() calls from all setup error paths\nand cleanup functions for wq, engine, and group structs, delegating\nsole ownership of those allocations to the release callbacks.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-08-28 08:16:55","updated_at":"2026-08-28 08:16:55"},"problem_types":[],"metrics":[],"references":[{"url":"https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c","name":"https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c","name":"https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-80698","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80698","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 394e179f51fce06d6bb8ca5af8fa53f33c718cf4 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected b09ad63775f58a8de3e228f59fb9543bfd964c9c git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 26c219e7522c494f7865a928c81ced84cc7db3ae git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 35ea8721d9e6e74c6847cf4d6c27e883b00b0331 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected e6f86fe368cdc14764833a6e8bb59f7a85a40e06 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.11.22 5.12 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.12.5 5.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.1.8 7.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"80698","cve":"CVE-2026-80698","epss":"0.001550000","percentile":"0.049960000","score_date":"2026-08-30","updated_at":"2026-08-31 00:14:06"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c","status":"affected","version":"7c5dd23e57c14cf7177b8a5e0fd08916e0c60005","versionType":"git"},{"lessThan":"ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c","status":"affected","version":"7c5dd23e57c14cf7177b8a5e0fd08916e0c60005","versionType":"git"},{"status":"affected","version":"394e179f51fce06d6bb8ca5af8fa53f33c718cf4","versionType":"git"},{"status":"affected","version":"b09ad63775f58a8de3e228f59fb9543bfd964c9c","versionType":"git"},{"status":"affected","version":"26c219e7522c494f7865a928c81ced84cc7db3ae","versionType":"git"},{"status":"affected","version":"35ea8721d9e6e74c6847cf4d6c27e883b00b0331","versionType":"git"},{"status":"affected","version":"e6f86fe368cdc14764833a6e8bb59f7a85a40e06","versionType":"git"},{"status":"affected","version":"1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886","versionType":"git"},{"lessThan":"5.12","status":"affected","version":"5.11.22","versionType":"semver"},{"lessThan":"5.13","status":"affected","version":"5.12.5","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/dma/idxd/init.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.8","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.1.8","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.5","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.11.22","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.12.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix double free of wq, engine, and group structs\n\nThe release callbacks for wq, engine, and group devices\n(idxd_conf_wq_release, idxd_conf_engine_release,\nidxd_conf_group_release) each call kfree() on the enclosing struct.\nThe setup error paths and cleanup functions also call kfree()\nexplicitly after put_device(), producing a double free whenever\nput_device() drops the reference count to zero and fires the release.\n\nIn the setup functions, device_initialize() is called before\ndevice_add(), so the reference count is exactly 1 at the error sites.\nput_device() unconditionally fires the release, which frees the struct;\nthe subsequent explicit kfree() then operates on freed memory.\n\nFor idxd_setup_wqs(), the wq release callback also owns opcap_bmap\nand wqcfg. The error unwind additionally freed those fields explicitly\nbefore calling put_device(), causing further double frees on both.\n\nRemove the redundant explicit kfree() calls from all setup error paths\nand cleanup functions for wq, engine, and group structs, delegating\nsole ownership of those allocations to the release callbacks."}],"providerMetadata":{"dateUpdated":"2026-08-28T06:53:02.829Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c"},{"url":"https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c"}],"title":"dmaengine: idxd: fix double free of wq, engine, and group structs","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-80698","datePublished":"2026-08-28T06:53:02.829Z","dateReserved":"2026-08-26T14:34:25.786Z","dateUpdated":"2026-08-28T06:53:02.829Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-08-28 08:16:55","lastModifiedDate":"2026-08-28 08:16:55","problem_types":[],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"80698","Ordinal":"1","Title":"dmaengine: idxd: fix double free of wq, engine, and group struct","CVE":"CVE-2026-80698","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"80698","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix double free of wq, engine, and group structs\n\nThe release callbacks for wq, engine, and group devices\n(idxd_conf_wq_release, idxd_conf_engine_release,\nidxd_conf_group_release) each call kfree() on the enclosing struct.\nThe setup error paths and cleanup functions also call kfree()\nexplicitly after put_device(), producing a double free whenever\nput_device() drops the reference count to zero and fires the release.\n\nIn the setup functions, device_initialize() is called before\ndevice_add(), so the reference count is exactly 1 at the error sites.\nput_device() unconditionally fires the release, which frees the struct;\nthe subsequent explicit kfree() then operates on freed memory.\n\nFor idxd_setup_wqs(), the wq release callback also owns opcap_bmap\nand wqcfg. The error unwind additionally freed those fields explicitly\nbefore calling put_device(), causing further double frees on both.\n\nRemove the redundant explicit kfree() calls from all setup error paths\nand cleanup functions for wq, engine, and group structs, delegating\nsole ownership of those allocations to the release callbacks.","Type":"Description","Title":"dmaengine: idxd: fix double free of wq, engine, and group struct"}]}}}