Use-After-Free and Double Free Vulnerability in Linux Kernel Auxiliary Device Management

CVE-2026-53286

What is CVE-2026-53286?

A vulnerability within the Linux kernel allows for potential double-frees and use-after-frees occurring during auxiliary device management. When the function auxiliary_device_add() encounters an error in either idpf_plug_vport_aux_dev() or idpf_plug_core_aux_dev(), it doesn't adequately handle resource clean-up, leading to a scenario where freed memory can be accessed again. This could allow attackers to exploit the flawed error handling during probe processes, which could have critical security implications for systems relying on the kernel's auxiliary device functionalities.

References