Import Source
https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98153.json
JSON Data
https://api.osv.dev/v1/vulns/AZL-98153
Upstream
Published
2026-08-28T08:16:55Z
Modified
2026-08-30T05:26:50Z
Summary
CVE-2026-80698 affecting package kernel 6.6.150.1-1
Details

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix double free of wq, engine, and group structs

The release callbacks for wq, engine, and group devices (idxdconfwqrelease, idxdconfenginerelease, idxdconfgrouprelease) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after putdevice(), producing a double free whenever put_device() drops the reference count to zero and fires the release.

In the setup functions, deviceinitialize() is called before deviceadd(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory.

For idxdsetupwqs(), the wq release callback also owns opcapbmap and wqcfg. The error unwind additionally freed those fields explicitly before calling putdevice(), causing further double frees on both.

Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.

References

Affected packages

Azure Linux:3 / kernel

Package

Name
kernel
Purl
pkg:rpm/azure-linux/kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
6.6.150.1-1

Database specific

source
"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-98153.json"