High 7.8Published Jun 26, 2026

CVE-2026-53286idpf: fix double free and use-after-free in aux device error paths

Updated under an hour ago (Oct 26, 2026, 2:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: idpf: fix double free and use-after-free in aux device error paths When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release callback (idpf_vport_adev_release / idpf_core_adev_release) that frees iadev. The fall-through then reads adev->id from the freed iadev for ida_free() and double-frees iadev with kfree(). Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately. Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 26, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f4312e6bfa2a98e94dacc75f96f916b76bdf4259 before 722b91d5086a249318c9d0e2b36aeac80ba8c808; from f4312e6bfa2a98e94dacc75f96f916b76bdf4259 before f319de7074e1728a9f9ff7134257360c694ec2b2; from f4312e6bfa2a98e94dacc75f96f916b76bdf4259 before 6c77b9510829a424d1b74409b7db9456e3522871	CNA record
linux linux_kernel linux:linux_kernel	from 6.17 before 6.18.33; from 6.19 before 7.0.10; 7.1; 7.1; 7.1	NVD

References

https://git.kernel.org/stable/c/722b91d5086a249318c9d0e2b36aeac80ba8c808patch
https://git.kernel.org/stable/c/f319de7074e1728a9f9ff7134257360c694ec2b2patch
https://git.kernel.org/stable/c/6c77b9510829a424d1b74409b7db9456e3522871patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.