CVE-2026-80698: dmaengine: idxd: fix double free of wq, engine, and group structs
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix double free of wq, engine, and group structs
The release callbacks for wq, engine, and group devices (idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after putdevice(), producing a double free whenever putdevice() drops the reference count to zero and fires the release.
In the setup functions, deviceinitialize() is called before deviceadd(), so the reference count is exactly 1 at the error sites. putdevice() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.
For idxdsetupwqs(), the wq release callback also owns opcapbmap and wqcfg. The error unwind additionally freed those fields explicitly before calling putdevice(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
Affected Software
Event History
Frequently Asked Questions
Under what conditions can the double free occur?
It occurs when idxd work queue, engine, or group setup reaches an error path, or when related cleanup runs, and put_device() drops the device reference count to zero. Because device_initialize() leaves the reference count at 1 before device_add(), the affected setup error paths trigger the release callback immediately.
Which allocations are additionally affected for work queues?
For work queues, the release callback owns the work-queue structure as well as opcap_bmap and wqcfg. The affected error unwind freed those fields explicitly before put_device(), so they could be freed again by the release callback.
What is the remediation described by the fix?
Remove explicit kfree() calls for work queue, engine, and group structures from setup error paths and cleanup functions. Their release callbacks should be the sole owners responsible for freeing these allocations.