CVE-2026-80698 Linux CVE debrief

Who should care

Linux system administrators, security teams, and developers using dmaengine idxd should assess exposure and apply patches or compensating controls. They should verify Linux kernel versions, review configurations, and inventory systems using dmaengine idxd to determine potential impact and prioritize remediation efforts.

Why it matters

A double-free vulnerability in dmaengine idxd affects Linux kernel versions. Defenders should verify exposure, apply patches or compensating controls, and monitor Linux kernel updates.

• Verify Linux kernel versions to determine exposure.
• Apply patches or compensating controls to prevent exploitation.
• Inventory Linux systems using dmaengine idxd to assess exposure.
• Monitor Linux kernel updates for fixes.

Technical summary

The dmaengine idxd component in the Linux kernel has a double-free vulnerability. Release callbacks for wq, engine, and group devices call kfree() on the enclosing struct. Setup error paths and cleanup functions also call kfree() explicitly after put_device(), resulting in a double free when put_device() drops the reference count to zero and fires the release. This vulnerability affects Linux kernel versions using dmaengine idxd. The issue arises from redundant explicit kfree() calls in setup error paths and cleanup functions, which cause double frees when combined with the release callbacks.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers to fix the double-free vulnerability.
• Update Linux kernel to a version that includes the fix.
• Inventory Linux systems using dmaengine idxd and assess exposure.
• Verify Linux kernel versions and apply compensating controls if patching is not feasible.
• Monitor Linux kernel updates for fixes.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. Linux system administrators and security teams should verify exposure by reviewing Linux kernel versions and configurations, assess potential impact on dmaengine idxd component usage, and apply patches or compensating controls as needed. The vulnerability affects Linux kernel versions using dmaengine idxd. Defenders should focus on validating configurations, patch

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.