Linux kernel idxd: wrong descriptor completed in llist_abort_desc() abort path

Impact

In the Intel DSA/IAA accelerator driver, llist_abort_desc() completed the wrong object in its final list_for_each_entry_safe() loop - the traversal cursor instead of the descriptor it had found. The commit names the consequences: NULL pointer dereference, double completion, or leaked descriptors. On datacenter hosts this is the in-kernel driver for Intel Data Streaming Accelerator, used for memory-move and compression offload alongside GPU workloads; the abort path is hit when descriptor submission fails, so the realistic outcome is a host kernel crash or leaked descriptors on a node that must then be drained. No tenant-controlled exploitation path is described in the record.

Who can reach it

Local, requiring a process with access to an idxd work queue (shared or dedicated DSA/IAA device) on a host where the driver is loaded; the bug lives in the submission-failure abort path. Hosts without Intel DSA/IAA enabled are not affected.

What to do

Take a stable kernel with the one-line fix (commits linked in the record) and reboot each host running idxd; drain workloads first. As an interim measure, disabling or unbinding idxd work queues removes exposure on nodes that do not use DSA/IAA offload.

References

Related entries

• Linux kernel (net/tls): When the crypto engine backlogs a kTLS encrypt request, both the async completion callback andCVE-2026-31533 · Linux kernel (net/tls)Critical
• Linux kernel (net/ipv4): A child socket created from an inbound handshake is inserted into the TCP hash table beforeCVE-2026-43198 · Linux kernel (net/ipv4)Critical
• Linux kernel qla2xxx: fcport double free on the ELS DCMD error pathCVE-2026-43414 · Linux kernel scsi qla2xxx (qla24xx_els_dcmd_iocb fcport lifetime)Critical
• Linux kernel mlx5_core RX datapath (striding RQ, page_pool): A regression introduced by the fix for CVE-2025-40350CVE-2026-43465 · Linux kernel mlx5_core RX datapath (striding RQ, page_pool)Critical
• Linux kernel pcrypt: EBUSY from backlogged requests is mishandled, corrupting completion accountingCVE-2026-43493 · Linux kernel crypto/pcrypt (MAY_BACKLOG request completion handling)Critical
• Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error paths: Three lifecycle bugs an initiator can driveCVE-2026-46135 · Linux kernel nvmet-tcp - ICReq/teardown race and data-digest error pathsCritical