CVE-2026-80698: dmaengine: idxd: fix double free of wq, engine, and group structs
dmaengine: idxd: fix double free of wq, engine, and group structs
Affected Software
Event History
Frequently Asked Questions
Under what conditions can the double free occur?
It occurs when idxd work queue, engine, or group setup reaches an error path, or when related cleanup runs, and put_device() drops the device reference count to zero. Because device_initialize() leaves the reference count at 1 before device_add(), the affected setup error paths trigger the release callback immediately.
Which allocations are additionally affected for work queues?
For work queues, the release callback owns the work-queue structure as well as opcap_bmap and wqcfg. The affected error unwind freed those fields explicitly before put_device(), so they could be freed again by the release callback.
What is the remediation described by the fix?
Remove explicit kfree() calls for work queue, engine, and group structures from setup error paths and cleanup functions. Their release callbacks should be the sole owners responsible for freeing these allocations.