CVE-2026-53286
Beschrijving NL
In de Linux kernel is de volgende kwetsbaarheid verholpen:
idpf: fix double free en use-after-free in aux device foutpaden
Wanneer auxiliary_device_add() mislukt in idpf_plug_vport_aux_dev() of
idpf_plug_core_aux_dev(), de err_aux_dev_add labeloproepen
auxiliary_device_uninit() en valt door naar err_aux_dev_init. De
uninit-oproep activeert put_device(), die de release aanroept
terugbellen (idpf_vport_adev_release / idpf_core_adev_release) dat bevrijdt
iadev. De doorval leest dan adev->id van de bevrijde iadev voor
ida_free() en double-frees iadev met kfree(). Maak de IDA-sleuf vrij en wis de back-pointer voordat u uninit, terwijl adev
nog steeds geldig is, dan direct retourneren. Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialisatie")
vast hetzelfde gebruik-na-vrij in het overeenkomende loskoppelpad in dit bestand, maar
miste beide sondefoutpaden.
Origineel (Engels) tonen
In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or
idpf_plug_core_aux_dev(), the err_aux_dev_add label calls
auxiliary_device_uninit() and falls through to err_aux_dev_init. The
uninit call will trigger put_device(), which invokes the release
callback (idpf_vport_adev_release / idpf_core_adev_release) that frees
iadev. The fall-through then reads adev->id from the freed iadev for
ida_free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.