CVE-2026-80698

A flaw was found in the dmaengine: idxd component of the Linux kernel. This vulnerability is caused by a double free error where memory allocated for work queue (wq), engine, and group structures is freed twice. This occurs because kfree() is explicitly called in error handling and cleanup routines, in addition to being called by the device release callbacks. A local attacker could potentially exploit this to cause a denial of service or have other unspecified impacts due to memory corruption.

A double free can occur in the dmaengine idxd driver because wq, engine, and group objects are freed by their device release callbacks and were also freed explicitly by setup error paths or cleanup functions after put_device. When put_device drops the reference count to zero, the release callback owns the final free, so a later kfree operates on already freed kernel memory. For the CVSS the PR:L is used in the paranoid score because a local actor with limited but relevant control over driver lifecycle, device management, or resource pressure may be able to reach error or cleanup paths in some deployments. The realistic base case is closer to PR:H because normal idxd load and remove operations are administrator controlled. The issue is not network reachable. Impact is at least local denial of service via kernel memory corruption and in the worst case may allow confidentiality or integrity impact if the double free can be shaped into a usable kernel heap corruption primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.