CVE-2026-74574 - dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
Brief
CVE ID : CVE-2026-74574
Published : Aug. 15, 2026, 1:18 p. m.
- 7 hours, 48 minutes ago
Description : In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()
The failed_dev_add and failed_dev_name paths drop the file-device reference while wq-wq_lock is still held. If put_device(fdev) drops the last reference, idxd_file_dev_release() runs synchronously and tries to take wq-wq_lock again, deadlocking.
Those paths also fall through into the later ctx cleanup labels even though idxd_file_dev_release() owns that cleanup and frees ctx. This can make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.
Move idxd_wq_get() before file-device setup can fail, since the release callback always calls idxd_wq_put().