dmaengine: idxd: Fix leaking event log memory (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix leaking event log memory During the device remove process, the device is reset, causing the configuration registers to go back to their default state, which is zero. As the driver is checking if the event log support was enabled before deallocating, it will fail if a reset happened before. Do not check if the support was enabled, the check for 'idxd->evl' being valid (only allocated if the HW capability is available) is enough.
Weaknesses (CWE)
- CWE-401 — Missing Release of Memory after Effective Lifetime
References
- https://git.kernel.org/stable/c/695b491dc3f20365fd5821f22e25dbe3c1c20cbc
- https://git.kernel.org/stable/c/d94f9b0ba28a205caf95902ee88b42bdb8af83d0
- https://git.kernel.org/stable/c/facd0012708e942fc12890708738aebde497564e
- https://git.kernel.org/stable/c/9dfa00967e6ef43a9dd0887fe5c3a721a39da92e
- https://git.kernel.org/stable/c/ee66bc29578391c9b48523dc9119af67bd5c7c0f
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-24768
- GCVE · GCVE-0-2026-31440
CERT-FR advisories
- CERTFR-2026-AVI-1066 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1064 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0954 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0927 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0926 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0548 — Multiples vulnérabilités dans le noyau Linux de Debian · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.4 < 6.12.80cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.13 < 6.18.21cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.19 < 6.19.11cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 244da66cda359227d80ccb41dbcb99da40eae186 < 695b491dc3f20365fd5821f22e25dbe3c1c20cbc ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < d94f9b0ba28a205caf95902ee88b42bdb8af83d0 ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < facd0012708e942fc12890708738aebde497564e ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < 9dfa00967e6ef43a9dd0887fe5c3a721a39da92e ; affected 244da66cda359227d80ccb41dbcb99da40eae186 < ee66bc29578391c9b48523dc9119af67bd5c7c0f |
| Linux · Linux | affected 6.4 ; unaffected 0 < 6.4 ; unaffected 6.6.140 ≤ 6.6.* ; unaffected 6.12.80 ≤ 6.12.* ; unaffected 6.18.21 ≤ 6.18.* ; unaffected 6.19.11 ≤ 6.19.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |