In the Linux kernel, the following vulnerability has been resolved:
idpf: fix double free and use-after-free in aux device error paths
When auxiliary_device_add() fails in idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), the err_aux_dev_add label calls auxiliary_device_uninit() and falls through to err_aux_dev_init. The uninit call will trigger put_device(), which invokes the release callback (idpf_vport_adev_release / idpf_core_adev_release) that frees iadev. The fall-through then reads adev->id from the freed iadev for ida_free() and double-frees iadev with kfree().
Free the IDA slot and clear the back-pointer before uninit, while adev is still valid, then return immediately.
Commit 65637c3a1811 ("idpf: fix UAF in RDMA core aux dev deinitialization") fixed the same use-after-free in the matching unplug path in this file but missed both probe error paths.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jun 26, 2026 |
| Ubuntu | — | Upgrade linux-image-oem-26.04aUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-azureUpgrade linux-image-generic-hwe-26.04Upgrade linux-image-gke-64k-7.0Upgrade linux-image-oem-24.04dUpgrade linux-image-awsUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-7.0.0-1015-raspiUpgrade linux-image-raspi-7.0Upgrade linux-image-7.0.0-1008-oracleUpgrade linux-image-7.0.0-1003-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-realtimeUpgrade linux-image-oem-26.04Upgrade linux-image-generic-64k-7.0Upgrade linux-image-generic-7.0Upgrade linux-image-oracle-64kUpgrade linux-image-oem-24.04Upgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-gcpUpgrade linux-image-raspiUpgrade linux-image-gke-7.0Upgrade linux-image-raspi-realtimeUpgrade linux-image-generic-64kUpgrade linux-image-oem-24.04aUpgrade linux-image-gcp-64k-7.0Upgrade linux-image-realtime-hwe-26.04Upgrade linux-image-aws-64kUpgrade linux-image-oem-24.04cUpgrade linux-image-oem-7.0Upgrade linux-image-7.0.0-1003-gke-64kUpgrade linux-image-7.0.0-1010-ibmUpgrade linux-image-azure-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-realtime-64kUpgrade linux-image-7.0.0-1015-raspi-realtimeUpgrade linux-image-7.0.0-1009-oemUpgrade linux-image-gke-64kUpgrade linux-image-7.0.0-1008-gcpUpgrade linux-image-aws-64k-7.0Upgrade linux-image-7.0.0-28-genericUpgrade linux-image-gke-hwe-26.04Upgrade linux-image-7.0.0-1009-azure-fdeUpgrade linux-image-virtualUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-7.0.0-28-realtime-64kUpgrade linux-image-7.0.0-28-realtimeUpgrade linux-image-ibm-7.0Upgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-gcp-7.0Upgrade linux-image-ibmUpgrade linux-image-7.0.0-1010-azureUpgrade linux-image-azure-fde-7.0Upgrade linux-image-aws-7.0Upgrade linux-image-7.0.0-28-generic-64kUpgrade linux-image-7.0.0-1008-gcp-64kUpgrade linux-image-7.0.0-1009-aws-64kUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-realtime-7.0Upgrade linux-image-7.0.0-1008-oracle-64kUpgrade linux-image-virtual-7.0Upgrade linux-image-raspi-realtime-7.0Upgrade linux-image-oem-24.04bUpgrade linux-image-genericUpgrade linux-image-7.0.0-1009-awsUpgrade linux-image-oracle-7.0Upgrade linux-image-oracleUpgrade linux-image-gkeUpgrade linux-image-azure-fde | Jul 20, 2026 | Jun 26, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub