Linux Kernel idxd double free

Summaryinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel. Impacted is the function idxd_conf_wq_release/idxd_conf_engine_release/idxd_conf_group_release of the component idxd. Performing a manipulation results in double free. This vulnerability is identified as CVE-2026-80698. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability classified as very critical has been found in Linux Kernel (affected version unknown). This affects the function idxd_conf_wq_release/idxd_conf_engine_release/idxd_conf_group_release of the component idxd. The manipulation with an unknown input leads to a double free vulnerability. CWE is classifying the issue as CWE-415. The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release. In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.

The advisory is shared at git.kernel.org. This vulnerability is uniquely identified as CVE-2026-80698 since 08/26/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details are known, but no exploit is available. The price for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/28/2026).

Applying the patch c93a9f652b7373ac8ee5bfcc18a9af76959b6c6c/ec2d428b2e32dd157de8f86a86dd85c5b2c8f45c is able to eliminate this problem.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion