CVE-2026-53286 is a vulnerability in Linux Kernel
Published on June 26, 2026
idpf: fix double free and use-after-free in aux device error paths
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or
idpf_plug_core_aux_dev(), the err_aux_dev_add label calls
auxiliary_device_uninit() and falls through to err_aux_dev_init. The
uninit call will trigger put_device(), which invokes the release
callback (idpf_vport_adev_release / idpf_core_adev_release) that frees
iadev. The fall-through then reads adev->id from the freed iadev for
ida_free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.
Products Associated with CVE-2026-53286
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version f4312e6bfa2a98e94dacc75f96f916b76bdf4259 and below 722b91d5086a249318c9d0e2b36aeac80ba8c808 is affected.
- Version f4312e6bfa2a98e94dacc75f96f916b76bdf4259 and below f319de7074e1728a9f9ff7134257360c694ec2b2 is affected.
- Version f4312e6bfa2a98e94dacc75f96f916b76bdf4259 and below 6c77b9510829a424d1b74409b7db9456e3522871 is affected.
- Version 6.17 is affected.
- Before 6.17 is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.