PT-2026-52925 · Undefined · Undefined
Published
2026-06-26
·
Updated
2026-06-26
·
CVE-2026-53286
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary device add() fails in idpf plug vport aux dev() or
idpf plug core aux dev(), the err aux dev add label calls
auxiliary device uninit() and falls through to err aux dev init. The
uninit call will trigger put device(), which invokes the release
callback (idpf vport adev release / idpf core adev release) that frees
iadev. The fall-through then reads adev->id from the freed iadev for
ida free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Undefined