UBUNTU-CVE-2026-80698: Double Free
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after putdevice(), producing a double free whenever putdevice() drops the reference count to zero and fires the release. In the setup functions, deviceinitialize() is called before deviceadd(), so the reference count is exactly 1 at the error sites. putdevice() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxdsetupwqs(), the wq release callback also owns opcapbmap and wqcfg. The error unwind additionally freed those fields explicitly before calling putdevice(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Remove the redundant explicit kfree() calls from the setup error paths and cleanup functions for wq, engine, and group structs, including the explicit frees of opcap_bmap and wqcfg in idxd_setup_wqs(); rely on put_device() and the release callbacks (idxd_conf_wq_release, idxd_conf_engine_release, and idxd_conf_group_release) to free the enclosing structs.