CVE-2026-80698 is a vulnerability in Linux Kernel
Published on August 28, 2026
dmaengine: idxd: fix double free of wq, engine, and group structs
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix double free of wq, engine, and group structs
The release callbacks for wq, engine, and group devices
(idxd_conf_wq_release, idxd_conf_engine_release,
idxd_conf_group_release) each call kfree() on the enclosing struct.
The setup error paths and cleanup functions also call kfree()
explicitly after put_device(), producing a double free whenever
put_device() drops the reference count to zero and fires the release.
In the setup functions, device_initialize() is called before
device_add(), so the reference count is exactly 1 at the error sites.
put_device() unconditionally fires the release, which frees the struct;
the subsequent explicit kfree() then operates on freed memory.
For idxd_setup_wqs(), the wq release callback also owns opcap_bmap
and wqcfg. The error unwind additionally freed those fields explicitly
before calling put_device(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths
and cleanup functions for wq, engine, and group structs, delegating
sole ownership of those allocations to the release callbacks.
Products Associated with CVE-2026-80698
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 and below c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c is affected.
- Version 7c5dd23e57c14cf7177b8a5e0fd08916e0c60005 and below ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c is affected.
- Version 394e179f51fce06d6bb8ca5af8fa53f33c718cf4 is affected.
- Version b09ad63775f58a8de3e228f59fb9543bfd964c9c is affected.
- Version 26c219e7522c494f7865a928c81ced84cc7db3ae is affected.
- Version 35ea8721d9e6e74c6847cf4d6c27e883b00b0331 is affected.
- Version e6f86fe368cdc14764833a6e8bb59f7a85a40e06 is affected.
- Version 1c28fd5f94d8996f7dd3805bd6a16ed46a5d0886 is affected.
- Version 5.11.22 and below 5.12 is affected.
- Version 5.12.5 and below 5.13 is affected.
- Version 5.13 is affected.
- Before 5.13 is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2, <= * is unaffected.