CVE-2026-53286

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the idpf driver where a double free and use-after-free occur during auxiliary device error paths. When the auxiliary device add() function fails within idpf plug vport aux dev() or idpf plug core aux dev(), the error handling process calls auxiliary device uninit(), which triggers put device(). This invokes the release callbacks idpf vport adev release() or idpf core adev release(), freeing the iadev object. Subsequently, the process attempts to read adev->id from the already freed iadev for ida free() and performs a second free of iadev using kfree().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.