CVE-2026-80698dmaengine: idxd: fix double free of wq, engine, and group structs
- —Not scoredno CVSS score yet
- 0.21%Exploitation in 30 daysEPSS · top 88% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release. In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
Timeline
ID reserved
By Linux
- 2 days later
· 2 days later
Published
- 2 months later
· 2 months later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.21% · top 88% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < 899aa2424a75b1812a1f4766e41e82315a521e7e
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < 84cf00b1376c717e55d704dc259483e822ae1b34
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < 38208445c41a6164e26748c600f954296991364d
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < 63844dc03960b09b36746eda636c08f1479407ce
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c
- affected 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 – < ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c
- affected 394e179f51fce06d6bb8ca5af8fa53f33c718cf4
- affected b09ad63775f58a8de3e228f59fb9543bfd964c9c
- affected 26c219e7522c494f7865a928c81ced84cc7db3ae
- affected 35ea8721d9e6e74c6847cf4d6c27e883b00b0331
- affected e6f86fe368cdc14764833a6e8bb59f7a85a40e06
- affected 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886
- affected 5.11.22 – < 5.12
- affected 5.12.5 – < 5.13
- affected 5.13
- unaffected < 5.13
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.160 – ≤ 6.6.*
- unaffected 6.12.114 – ≤ 6.12.*
- unaffected 6.18.57 – ≤ 6.18.*
- unaffected 7.1.8 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/899aa2424a75b1812a1f4766e41e82315a521e7e (opens in a new tab)
- https://git.kernel.org/stable/c/84cf00b1376c717e55d704dc259483e822ae1b34 (opens in a new tab)
- https://git.kernel.org/stable/c/38208445c41a6164e26748c600f954296991364d (opens in a new tab)
- https://git.kernel.org/stable/c/63844dc03960b09b36746eda636c08f1479407ce (opens in a new tab)
- https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c (opens in a new tab)
- https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-67433 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-80698)Record last updated .