CVE-2026-53286

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix double free and use-after-free in aux device error paths

When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or

idpf_plug_core_aux_dev(), the err_aux_dev_add label calls

auxiliary_device_uninit() and falls through to err_aux_dev_init. The

uninit call will trigger put_device(), which invokes the release

callback (idpf_vport_adev_release / idpf_core_adev_release) that frees

iadev. The fall-through then reads adev->id from the freed iadev for

ida_free() and double-frees iadev with kfree().

Free the IDA slot and clear the back-pointer before uninit, while adev

is still valid, then return immediately.

Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")

fixed the same use-after-free in the matching unplug path in this file but

missed both probe error paths.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References