{"id":"CVE-2026-74574","title":"dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()\n\nThe failed_dev_add and failed_dev_name paths drop the file-device\nreference while wq->wq_lock is st…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 778ccbded2c8749c5be7f0dfa04fc9977a36fb7e","Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 8d5d28285728be47c82fdf1c48be4268293c90e7","Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 0679c0c189d2548f00e1bac95be28e2df5c6c7f7","Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 6e26a41c4c1a706edaaa7c7dffc6b3b945707a55","Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < ee1d7274102285d78a53161fc705a8d8cd40b066","Linux 6.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T19:00:43.194808Z"},"published":"2026-08-15","updated":"2026-10-16","sourceUpdated":"2026-10-16T19:05:57.115Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74574","references":[{"url":"https://git.kernel.org/stable/c/778ccbded2c8749c5be7f0dfa04fc9977a36fb7e"},{"url":"https://git.kernel.org/stable/c/8d5d28285728be47c82fdf1c48be4268293c90e7"},{"url":"https://git.kernel.org/stable/c/0679c0c189d2548f00e1bac95be28e2df5c6c7f7"},{"url":"https://git.kernel.org/stable/c/6e26a41c4c1a706edaaa7c7dffc6b3b945707a55"},{"url":"https://git.kernel.org/stable/c/ee1d7274102285d78a53161fc705a8d8cd40b066"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.01825,"ingestedAt":"2026-10-16T19:46:24.340Z","slug":"CVE-2026-74574","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()\n\nThe failed_dev_add and failed_dev_name paths drop the file-device\nreference while wq->wq_lock is still held. If put_device(fdev) drops the\nlast reference, idxd_file_dev_release() runs synchronously and tries to\ntake wq->wq_lock again, deadlocking.\n\nThose paths also fall through into the later ctx cleanup labels even\nthough idxd_file_dev_release() owns that cleanup and frees ctx. This can\nmake idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.\n\nMove idxd_wq_get() before file-device setup can fail, since the release\ncallback always calls idxd_wq_put(). Then unlock wq->wq_lock before\nput_device(fdev) and return directly from the file-device setup failure\npath, leaving ctx cleanup to the release callback.\n\n## Affected\n\n- `Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 778ccbded2c8749c5be7f0dfa04fc9977a36fb7e`\n- `Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 8d5d28285728be47c82fdf1c48be4268293c90e7`\n- `Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 0679c0c189d2548f00e1bac95be28e2df5c6c7f7`\n- `Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < 6e26a41c4c1a706edaaa7c7dffc6b3b945707a55`\n- `Linux >= e6fd6d7e5f0fe4a17a08e892afb5db800e7794ec < ee1d7274102285d78a53161fc705a8d8cd40b066`\n- `Linux 6.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}