CVE-2026-80698: dmaengine: idxd: fix double free of wq, engine, and group structs
dmaengine: idxd: fix double free of wq, engine, and group structs
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.8-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.8 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Compensating control
Remove redundant explicit kfree() calls from all setup error paths and cleanup functions for workqueue (wq), engine, and group structs, including explicit frees of opcap_bmap and wqcfg in the workqueue cleanup path; let the device release callbacks retain sole ownership and free these allocations.
Event History
Frequently Asked Questions
Under what conditions can the double free occur?
It occurs when idxd work queue, engine, or group setup reaches an error path, or when related cleanup runs, and put_device() drops the device reference count to zero. Because device_initialize() leaves the reference count at 1 before device_add(), the affected setup error paths trigger the release callback immediately.
Which allocations are additionally affected for work queues?
For work queues, the release callback owns the work-queue structure as well as opcap_bmap and wqcfg. The affected error unwind freed those fields explicitly before put_device(), so they could be freed again by the release callback.
What is the remediation described by the fix?
Remove explicit kfree() calls for work queue, engine, and group structures from setup error paths and cleanup functions. Their release callbacks should be the sole owners responsible for freeing these allocations.