---
id: CVE-2026-53286
title: 'idpf: fix double free and use-after-free in aux device error paths'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  idpf: fix double free and use-after-free in aux device error paths

  When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or
  idpf_plug_core_aux_dev(), the err_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 <
    722b91d5086a249318c9d0e2b36aeac80ba8c808
  - >-
    Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 <
    f319de7074e1728a9f9ff7134257360c694ec2b2
  - >-
    Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 <
    6c77b9510829a424d1b74409b7db9456e3522871
  - Linux 6.17
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:25:17.978547Z'
published: '2026-06-26'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:17.925Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-53286'
references:
  - url: 'https://git.kernel.org/stable/c/722b91d5086a249318c9d0e2b36aeac80ba8c808'
  - url: 'https://git.kernel.org/stable/c/f319de7074e1728a9f9ff7134257360c694ec2b2'
  - url: 'https://git.kernel.org/stable/c/6c77b9510829a424d1b74409b7db9456e3522871'
tags:
  - cve.org
epss: 0.00126
epssPercentile: 0.02336
ingestedAt: '2026-11-06T16:57:43.255Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix double free and use-after-free in aux device error paths

When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or
idpf_plug_core_aux_dev(), the err_aux_dev_add label calls
auxiliary_device_uninit() and falls through to err_aux_dev_init.  The
uninit call will trigger put_device(), which invokes the release
callback (idpf_vport_adev_release / idpf_core_adev_release) that frees
iadev.  The fall-through then reads adev->id from the freed iadev for
ida_free() and double-frees iadev with kfree().

Free the IDA slot and clear the back-pointer before uninit, while adev
is still valid, then return immediately.

Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization")
fixed the same use-after-free in the matching unplug path in this file but
missed both probe error paths.

## Affected

- `Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 < 722b91d5086a249318c9d0e2b36aeac80ba8c808`
- `Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 < f319de7074e1728a9f9ff7134257360c694ec2b2`
- `Linux >= f4312e6bfa2a98e94dacc75f96f916b76bdf4259 < 6c77b9510829a424d1b74409b7db9456e3522871`
- `Linux 6.17`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.