CVE-2026-80698
NoneCVSS
—
EPSS
0.2%
Published
Aug 28, 2026
CISA due date
—
Cloudanix analysis
A bug in Linux kernel code for certain hardware devices could let an attacker crash the system or possibly gain higher privileges by messing with memory during device setup.
- Exploitation
- Local Privilege
- Attacker needs
- Low Privilege
- Complexity
- Moderate
- Impact
- Privilege Gain
- Component
- OS kernel
- Class
- Memory Corruption
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Double free vulnerability in Linux kernel idxd dmaengine driver where release callbacks for wq/engine/group devices call kfree on structs after put_device triggers the same free via reference count drop to zero; also affects opcap_bmap and wqcfg in wq paths.
Why it matters to the business
Kernel memory corruption on Linux systems using idxd devices can cause crashes, denial of service, or potential privilege escalation during device setup or error handling.
How an attack unfolds
An attacker with local access triggers error paths in idxd_setup_wqs or similar setup functions that call put_device followed by explicit kfree on already-freed memory, or causes reference count paths that invoke release callbacks multiple times.
How to fix it
Update to a Linux kernel version containing the fix that removes redundant kfree calls from setup error paths and cleanup functions for wq, engine, and group structs.
How to confirm the fix worked
Confirm kernel source or binary no longer contains explicit kfree after put_device in idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release, and related setup functions; test device initialization error paths.
Typical attack path
- Obtain local code execution or user access on affected Linux kernel
- Interact with idxd device initialization or force error conditions in wq/engine/group setup
- Trigger put_device paths that invoke release callbacks
- Execute redundant kfree on freed structs to corrupt kernel memory
How to detect it
Review kernel logs for oops or panic messages involving idxd wq/engine/group release or double free patterns; inspect audit logs for unusual idxd device access preceding crashes.
What your security team should do
- Apply the kernel patch or upgrade to a fixed mainline or distribution kernel immediately
- Monitor for idxd-related kernel oops or memory corruption events
- Restrict unprivileged access to idxd device interfaces until patched
The record
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release. In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|