CVE-2026-80698 in Linux
Summary
by MITRE • 08/28/2026
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix double free of wq, engine, and group structs
The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release.
In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.
For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both.
Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The identified vulnerability resides within the Intel DMA Engine Driver (idxd) subsystem of the Linux kernel, specifically affecting the management structures for work queues, engines, and device groups. This issue manifests as a double free condition triggered during error handling paths or cleanup routines when initializing these hardware resources. The core technical flaw stems from an incorrect ownership model regarding memory allocation and deallocation for the idxd_conf_wq, idxd_conf_engine, and idxd_conf_group structures. In this subsystem, release callbacks such as idxd_conf_wq_release, idxd_conf_engine_release, and idxd_conf_group_release are designed to handle the final cleanup of these objects by calling kfree on the enclosing struct when the device reference count drops to zero. However, the setup functions for these devices invoke device_initialize followed by device_add, establishing an initial reference count of one. When a failure occurs during initialization or addition, the error handling code explicitly calls put_device to decrement this reference count and subsequently invokes kfree manually on the same pointer that was already freed by the release callback triggered by put_device.
This architectural mismatch leads to undefined behavior characterized by double free vulnerabilities, which are classified under CWE-415 in standard vulnerability taxonomy. The operational impact of such a flaw is severe, as freeing memory twice corrupts the kernel heap allocator metadata structures like slab caches or buddy system freelists. This corruption can lead to immediate kernel panics and system crashes if the freed memory has not yet been reallocated for other purposes. More critically, in an exploited scenario where an attacker can influence the allocation patterns of the kernel heap after the first free but before the second free attempt, this vulnerability could potentially be leveraged for arbitrary code execution or privilege escalation. The double write to a previously freed object allows attackers to manipulate memory contents, bypassing standard security mitigations that rely on intact allocator structures to detect corruption.
The specific complexity of this issue is heightened in the idxd_setup_wqs function, where additional resources such as opcap_bmap and wqcfg are allocated alongside the main work queue structure. The error unwind logic previously attempted to free these subsidiary fields explicitly before calling put_device. Since the release callback also assumes ownership over these embedded pointers during its cleanup phase, this results in further double frees for these auxiliary data structures. This layered approach to resource management created multiple points of failure where memory safety guarantees were violated due to redundant deallocation calls operating on already released memory regions.
To remediate this vulnerability, the redundant explicit kfree calls within all setup error paths and general cleanup functions must be removed. The correct design pattern requires that sole ownership of these allocations is delegated entirely to the respective release callbacks. By ensuring that put_device is the only mechanism triggering the deallocation sequence via the reference counting subsystem, the kernel maintains a consistent state for memory management. This change aligns with standard Linux kernel driver development practices where device structures managed by the device core should not be manually freed in error paths if their lifecycle is tied to the device's reference count. Implementing this fix eliminates the race condition and logical errors associated with double frees, thereby restoring heap integrity and preventing potential exploitation vectors related to memory corruption. This resolution ensures that resource cleanup occurs exactly once per object lifetime, adhering to robust software engineering principles for kernel-space drivers.