CVE-2026-80698: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80698 Overview

CVE-2026-80698 is a double free vulnerability in the Linux kernel's Intel Data Streaming Accelerator (idxd) dmaengine driver. The flaw resides in the setup and cleanup paths for work queue (wq), engine, and group device structures. Release callbacks (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) already call kfree() on the enclosing struct. The setup error paths and cleanup functions also invoke kfree() explicitly after put_device(), causing a double free when the reference count drops to zero.

Critical Impact
The double free corrupts kernel heap memory during driver initialization failure or teardown, potentially leading to kernel panic, memory corruption, or exploitable use-after-free conditions.

Affected Products

Linux kernel builds containing the dmaengine: idxd driver
Systems using Intel Data Streaming Accelerator (DSA) or Intel Analytics Accelerator (IAA) hardware
Distributions shipping the affected idxd driver prior to the referenced upstream fixes

Discovery Timeline

2026-08-28 - CVE-2026-80698 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80698

Vulnerability Analysis

The idxd driver manages configuration objects for Intel accelerator hardware. Each wq, engine, and group is represented as a device with its own release callback. During device registration, device_initialize() sets the reference count to 1 before device_add() is invoked. When setup fails, the error path calls put_device(), which drops the refcount to zero and unconditionally fires the release callback.

The release callbacks free the enclosing struct via kfree(). The error unwind then executes a redundant kfree() on the same pointer, producing a classic double free [CWE-415]. For idxd_setup_wqs(), the impact widens because the wq release callback also owns opcap_bmap and wqcfg. The error path explicitly freed these fields before calling put_device(), producing additional double frees on both members.

Root Cause

Ownership of the allocations was ambiguous between the release callback and the setup error paths. Both code paths assumed responsibility for freeing the same memory, violating single-owner allocation discipline for reference-counted kernel objects.

Attack Vector

Triggering the flaw requires reaching the driver's setup error path or cleanup routine. A local actor with the ability to induce initialization failure of the idxd driver, or an unexpected teardown, can cause the double free. The vulnerability manifests during kernel-internal execution and does not require crafted userspace payloads; the corrupted heap state may then be leveraged for further exploitation. See the upstream commit c93a9f65 and commit ec2d428b for the patched code paths.

Detection Methods for CVE-2026-80698

Indicators of Compromise

Kernel oops or panic messages referencing idxd_conf_wq_release, idxd_conf_engine_release, or idxd_conf_group_release
KASAN reports flagging double-free in kfree() originating from idxd_setup_wqs, idxd_setup_engines, or idxd_setup_groups
Unexpected idxd driver probe failures followed by heap corruption warnings in dmesg

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface double-free conditions during idxd probe and teardown.
Audit installed kernel versions against the upstream stable commits referenced in the fix to determine exposure.
Monitor dmesg and journald for repeated idxd initialization failures which may indicate exploitation attempts against error paths.

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces referencing the idxd release callbacks.
Track kernel package versions across the fleet to ensure patched builds are deployed on hosts with Intel DSA or IAA hardware.
Review driver load and unload events on systems that expose accelerator resources to workloads or containers.

How to Mitigate CVE-2026-80698

Immediate Actions Required

Apply the upstream kernel patches referenced by commits c93a9f65 and ec2d428b or upgrade to a distribution kernel that includes them.
Inventory hosts that load the idxd driver and prioritize patching on systems using Intel DSA or IAA hardware.
Restrict local access on affected systems until patched kernels are deployed.

Patch Information

The fix removes the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs. Sole ownership of the allocations, including opcap_bmap and wqcfg for wq, is delegated to the release callbacks. Refer to the Kernel Git commit c93a9f65 and Kernel Git commit ec2d428b for full details.

Workarounds

Blacklist the idxd kernel module on systems that do not require Intel accelerator functionality until patches are applied.
Unbind idxd devices from the driver via sysfs on hosts where the accelerator is not in active use.
Limit local login and container privileges that would allow inducing driver setup failures.

bash

# Blacklist the idxd module until patched kernel is deployed
echo "blacklist idxd" | sudo tee /etc/modprobe.d/blacklist-idxd.conf
sudo update-initramfs -u

# Verify kernel version against patched build
uname -r