CVE-2026-53286: idpf: fix double free and use-after-free in aux device error paths
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliarydeviceadd() fails in idpfplugvportauxdev() or idpfplugcoreauxdev(), the errauxdevadd label calls auxiliarydeviceuninit() and falls through to errauxdevinit. The uninit call will trigger putdevice(), which invokes the release callback (idpfvportadevrelease / idpfcoreadevrelease) that frees iadev. The fall-through then reads adev->id from the freed iadev for idafree() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53286?
The severity of CVE-2026-53286 is classified as risk level 34.
What type of vulnerabilities does CVE-2026-53286 address?
CVE-2026-53286 addresses Use After Free and Double Free vulnerabilities in the Linux kernel.
How do I fix CVE-2026-53286?
To fix CVE-2026-53286, update to the latest version of the Linux kernel that includes the patch for this vulnerability.
What is the impact of CVE-2026-53286?
The impact of CVE-2026-53286 can lead to system instability or exploitation if the vulnerabilities in auxiliary device error paths are exploited.
In which component of the Linux kernel is CVE-2026-53286 found?
CVE-2026-53286 is found in the idpf component of the Linux kernel.