In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix double free of wq, engine, and group structs

The release callbacks for wq, engine, and group devices (idxd conf wq release, idxd conf engine release, idxd conf group release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put device(), producing a double free whenever put device() drops the reference count to zero and fires the release.

In the setup functions, device initialize() is called before device add(), so the reference count is exactly 1 at the error sites. put device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.

For idxd setup wqs(), the wq release callback also owns opcap bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put device(), causing further double frees on both.

Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.