In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release. In the setup functions, device_initialize() is called before device_add(), so the reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields explicitly before calling put_device(), causing further double frees on both. Remove the redundant explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs, delegating sole ownership of those allocations to the release callbacks.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - dmaengine: idxd: fix double free of wq, engine, and group structs The release callbacks for wq, engine,     and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call     kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly     after put_device(), producing a double free whenever put_device() drops the reference count to zero and     fires the release. In the setup functions, device_initialize() is called before device_add(), so the     reference count is exactly 1 at the error sites. put_device() unconditionally fires the release, which     frees the struct; the subsequent explicit kfree() then operates on freed memory. For idxd_setup_wqs(), the     wq release callback also owns opcap_bmap and wqcfg. The error unwind additionally freed those fields     explicitly before calling put_device(), causing further double frees on both. Remove the redundant     explicit kfree() calls from all setup error paths and cleanup functions for wq, engine, and group structs,     delegating sole ownership of those allocations to the release callbacks. (CVE-2026-80698)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
379497	SUSE SLES16 Security Update : kernel (SUSE-SU-2026:24651-1)	Nessus	SuSE Local Security Checks	Local	high
379474	SUSE SLES16: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:24662-1)	Nessus	SuSE Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
376285	SUSE SLED15: cluster-md-kmp-default / dlm-kmp-default / gfs2-kmp-default / etc (SUSE-SU-2026:5091-1)	Nessus	SuSE Local Security Checks	Local	critical
341321	Linux Distros Unpatched Vulnerability : CVE-2026-80698	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-80698

medium

Tenable Plugins

high

high

high

critical

medium