Executive brief
The Linux kernel's dmaengine idxd driver (used for Intel Data Streaming Accelerator hardware) contains a critical bug in file device setup that can cause system deadlock or memory corruption. When opening an idxd device file fails during initialization, the code attempts to release resources while holding a lock, then tries to re-acquire that same lock, freezing the system. Additionally, freed memory can be incorrectly accessed after being released, potentially allowing memory corruption or information disclosure.
Technical details
The vulnerability is a deadlock and use-after-free bug in idxd_cdev_open() within drivers/dma/idxd/cdev.c. The root cause: when device setup fails at the failed_dev_name or failed_dev_add error paths, the code calls put_device(fdev) while holding wq->wq_lock. If this releases the last reference, the synchronous release callback idxd_file_dev_release() attempts to acquire the same lock, causing deadlock. Additionally, the error paths fall through to later cleanup code that operates on memory already freed by the release callback (idxd_xa_pasid_remove and kfree on ctx). The fix moves idxd_wq_get() before device setup can fail and explicitly unlocks wq->wq_lock before put_device(fdev), then returns directly instead of falling through. Attack requires local unprivileged user access to open the idxd character device. Patches are available in stable kernel trees.
Affected products
- Linux Linux kernel Multiple versions affected (see stable kernel commits)
Timeline
- 2026-08-15: disclosed: Published to NVD
- 2026-05-25: patched: Patch submitted by Yuho Choi
- 2026-08-09: patched: Merged to stable kernel trees