CVE-2026-53286

A flaw was found in the Linux kernel. Specifically, a double free and use-after-free vulnerability exists in the idpf driver's auxiliary device error paths. This flaw occurs when auxiliary_device_add() fails, leading to improper memory handling where memory is freed twice or accessed after being freed. This can result in system instability, denial of service (DoS), or potentially lead to arbitrary code execution.

This vulnerability is rated as Moderate severity because exploitation requires local access and the presence of Intel Infrastructure Data Path Function (idpf) network hardware, restricting the blast radius primarily to a local denial of service. The issue triggers only during auxiliary device attachment failures within the driver probe sequence, which is not encountered during standard runtime operations. Systems that do not utilize idpf network adapters or do not experience hardware configuration errors are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.