CVE-2026-80698

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double free issue exists in the dmaengine idxd component. The release callbacks idxd conf wq release(), idxd conf engine release(), and idxd conf group release() call kfree() on the enclosing struct. However, setup error paths and cleanup functions also explicitly call kfree() after put device(). When put device() drops the reference count to zero, it triggers the release callback, leading to a double free when the subsequent explicit kfree() is executed. In idxd setup wqs(), this also affects the opcap bmap and wqcfg fields, as they are freed both in the error unwind and the release callback.

Recommendations Remove redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs to ensure sole ownership of allocations is handled by the release callbacks.