PT-2026-52925 · Undefined · Undefined
Publicado
2026-06-26
·
Atualizado
2026-06-26
·
CVE-2026-53286
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary device add() fails in idpf plug vport aux dev() or
idpf plug core aux dev(), the err aux dev add label calls
auxiliary device uninit() and falls through to err aux dev init. The
uninit call will trigger put device(), which invokes the release
callback (idpf vport adev release / idpf core adev release) that frees
iadev. The fall-through then reads adev->id from the freed iadev for
ida free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Undefined