Linux kernel idxd: double free of wq, engine and group structs on setup error and cleanup paths

CVE-2026-80698Kernel, userspace & hypervisorcurated

Impact

The release callbacks for idxd wq, engine and group devices already kfree() the enclosing struct, while the setup error paths and cleanup functions called kfree() again after put_device() dropped the last reference. For work queues the wq release callback also owns opcap_bmap and wqcfg, which the error unwind freed separately, so those are double-freed too. Any probe failure or driver teardown on an Intel DSA/IAA device therefore corrupts the kernel heap instead of failing cleanly. DSA is on-die on current Xeon hosts, including GPU-server head nodes where it is bound for memory-copy offload, but the path is only entered on driver initialisation failure or module removal - not by tenant workloads.

Who can reach it

Local and privileged: requires the ability to unbind or remove the idxd driver, or a device that fails probe at boot. Not reachable from an unprivileged process or a container.

What to do

Install a stable kernel with the redundant kfree() calls removed and reboot the node - the fix is compiled into the driver, so reloading idxd on an unpatched kernel does not help. On unpatched hosts, avoid rmmod/unbind of idxd.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-80698 https://git.kernel.org/stable/c/c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c https://git.kernel.org/stable/c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.