dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the last reference, idxd_file_dev_release() runs synchronously and tries to take wq->wq_lock again, deadlocking. Those paths also fall through into the later ctx cleanup labels even though idxd_file_dev_release() owns that cleanup and frees ctx. This can make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context. Move idxd_wq_get() before file-device setup can fail, since the release callback always calls idxd_wq_put(). Then unlock wq->wq_lock before put_device(fdev) and return directly from the file-device setup failure path, leaving ctx cleanup to the release callback.
CVE-2026-74574
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-74574
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"lessThan": "778ccbded2c8749c5be7f0dfa04fc9977a36fb7e",
"versionType": "git"
},
{
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"lessThan": "8d5d28285728be47c82fdf1c48be4268293c90e7",
"versionType": "git"
},
{
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"lessThan": "0679c0c189d2548f00e1bac95be28e2df5c6c7f7",
"versionType": "git"
},
{
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"lessThan": "6e26a41c4c1a706edaaa7c7dffc6b3b945707a55",
"versionType": "git"
},
{
"status": "affected",
"version": "e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec",
"lessThan": "ee1d7274102285d78a53161fc705a8d8cd40b066",
"versionType": "git"
}
],
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.151",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.103",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.8",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/dma/idxd/cdev.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-74574
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #33213 · Revision 1
- Added to Heist Feed
- Publisher date