CVE-2026-53286

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix double free and use-after-free in aux device error paths

When auxiliarydeviceadd() fails in idpfplugvportauxdev() or idpfplugcoreauxdev(), the errauxdevadd label calls auxiliarydeviceuninit() and falls through to errauxdevinit. The uninit call will trigger putdevice(), which invokes the release callback (idpfvportadevrelease / idpfcoreadevrelease) that frees iadev. The fall-through then reads adev->id from the freed iadev for idafree() and double-frees iadev with kfree().

Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately.

Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths.