CVE-2026-74574

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix fdev setup failure cleanup in idxd_cdev_open()

The failed_dev_add and failed_dev_name paths drop the file-device

reference while wq->wq_lock is still held. If put_device(fdev) drops the

last reference, idxd_file_dev_release() runs synchronously and tries to

take wq->wq_lock again, deadlocking.

Those paths also fall through into the later ctx cleanup labels even

though idxd_file_dev_release() owns that cleanup and frees ctx. This can

make idxd_xa_pasid_remove(ctx) and kfree(ctx) operate on a freed context.

Move idxd_wq_get() before file-device setup can fail, since the release

callback always calls idxd_wq_put(). Then unlock wq->wq_lock before

put_device(fdev) and return directly from the file-device setup failure

path, leaving ctx cleanup to the release callback.