Linux kernel idxd: double free of wq, engine and group structs on setup error and cleanup paths

Impact

The release callbacks for idxd wq, engine and group devices already kfree() the enclosing struct, while the setup error paths and cleanup functions called kfree() again after put_device() dropped the last reference. For work queues the wq release callback also owns opcap_bmap and wqcfg, which the error unwind freed separately, so those are double-freed too. Any probe failure or driver teardown on an Intel DSA/IAA device therefore corrupts the kernel heap instead of failing cleanly. DSA is on-die on current Xeon hosts, including GPU-server head nodes where it is bound for memory-copy offload, but the path is only entered on driver initialisation failure or module removal - not by tenant workloads.

Who can reach it

Local and privileged: requires the ability to unbind or remove the idxd driver, or a device that fails probe at boot. Not reachable from an unprivileged process or a container.

What to do

Install a stable kernel with the redundant kfree() calls removed and reboot the node - the fix is compiled into the driver, so reloading idxd on an unpatched kernel does not help. On unpatched hosts, avoid rmmod/unbind of idxd.

References

Related entries

• Linux kernel KVM arm64 vGIC: double-deactivate of nested IRQs trips an AmpereOne erratumCVE-2026-80699 · Linux kernel KVM/arm64 vGIC (nested-context IRQ deactivation)Unscored
• Linux kernel MGLRU: stale batch updates after memcg reparenting cause premature OOM killsCVE-2026-80719 · Linux kernel mm MGLRU (per-generation batch accounting across memcg reparenting)Unscored
• Linux kernel KVM x86 MMU: invalid parent role propagates to child shadow pages, use-after-freeCVE-2026-80726 · Linux kernel KVM x86 shadow MMU (child shadow page role derivation)Unscored
• Linux kernel x86/mce: CMCI discovery kicks the MCE polling timer before it is initializedCVE-2026-80727 · Linux kernel x86 MCE (CMCI discovery vs. polling timer initialization order)Unscored
• Linux kernel mm: folio split leaves memcg-charged page-cache xa_nodes off the shadow_nodes list_lruCVE-2026-80729 · Linux kernel mm/huge_memory (page-cache folio split, shadow_nodes list_lru accounting)Unscored
• Linux nvmet-tcp: remote initiator can trip a kernel WARN via an oversized SGL, killing panic-on-warn hostsCVE-2026-80788 · Linux kernel nvmet-tcp (NVMe-over-TCP target SGL allocation)Unscored