Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open() The failed_dev_add and failed_dev_name paths drop the file-device reference while wq->wq_lock is still held. If put_device(fdev) drops the last reference, idxd_file_dev_release() runs synchronously and tries to take wq->wq_lock again, deadlocking. Those paths also fall through into the later ctx cleanup labels even though idxd_file_dev_release() owns that cleanup and frees ctx. This can make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context. Move idxd_wq_get() before file-device setup can fail, since the release callback always calls idxd_wq_put(). Then unlock wq->wq_lock before put_device(fdev) and return directly from the file-device setup failure path, leaving ctx cleanup to the release callback.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-08-15T13:18:03.063Z",
  "pubdate": "2026-08-15T13:18:03.063Z",
  "executiveSummary": "A deadlock vulnerability exists in the Linux kernel Data Mover and Accelerator Driver (dmaengine) subsystem, specifically within the Intel Data Accelerator (idxd) driver. The flaw arises from improper handling of lock acquisition and reference counting during file-device setup failures in the idxd_cdev_open() function. When device initialization fails while holding the wq->wq_lock, invoking put_device(fdev) can synchronously trigger the idxd_file_dev_release() callback, which attempts to acquire the already held lock, resulting in a system deadlock. Additionally, fall-through error handling paths can lead to use-after-free conditions on the context structure due to premature cleanup. The impact of this vulnerability is localized Denial of Service (DoS) affecting system availability, as the deadlock causes thread or CPU hang within the kernel execution context. Exploitation typically requires local access to the character device interface exposed by the idxd driver and the ability to trigger error paths during file opening operations. No specific privilege requirements beyond access to the accelerator character device are inherently required, though system-level execution context is mandated due to the kernel-space nature of the bug. Mitigation involves applying the official kernel patch that refactors the lock handling, reference counting order, and error cleanup pathways.",
  "technicalDetails": "The vulnerability resides in the Linux kernel idxd subsystem, specifically within the driver initialization and file opening logic handled by idxd_cdev_open(). The root cause is a concurrency and synchronization defect involving the wq->wq_lock mutex and object reference counting managed via put_device() and the idxd_file_dev_release() destructor callback. During the execution of idxd_cdev_open(), if a failure occurs along the failed_dev_add or failed_dev_name error handling paths, the kernel code drops a reference to the file-device (fdev) using put_device(fdev) while the critical mutex wq->wq_lock remains actively held by the current thread. If the reference count on fdev drops to zero, the kernel immediately and synchronously invokes the registered release callback function, idxd_file_dev_release(). Within idxd_file_dev_release(), the execution flow attempts to acquire wq->wq_lock to perform necessary cleanup operations. Because the calling thread already holds this mutex, a classic self-deadlock occurs, freezing the execution thread indefinitely and impacting overall system responsiveness or availability. Furthermore, the error handling logic suffers from control flow fall-through issues. After executing the device reference drop, the execution flow incorrectly falls through into subsequent context cleanup labels. Because idxd_file_dev_release() is designed to independently own and execute the cleanup of the context (ctx), the redundant execution leads to unsafe operations such as idxd_xa_pasid_remove(ctx) and kfree(ctx) acting upon an already freed or doubly freed context structure. This creates a severe potential for use-after-free conditions alongside the primary deadlock vector. The attack flow requires a local user or process to interact with the idxd character device nodes, forcing an error condition during the open sequence—such as resource allocation failures or device addition errors—that drives execution into the flawed cleanup paths. Exploitation is deterministic when the precise race condition or error path is triggered by a process possessing read-write access to the accelerator subsystem device files. The vulnerable component is the idxd character device management logic within drivers/dma/idxd/cdev.c of the Linux kernel. Affected versions include any kernel build containing the flawed idxd_cdev_open() error handling logic prior to the application of the corrective patch. Network exposure is non-existent as the attack vector requires local interface access, and authentication requirements are limited to local system access with permissions to open the accelerator character devices."
}