HIGH Introduced in 6.7
idpf DimWork UAF
CVE-2026-97603
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing q_vectors idpf never drains the Tx/Rx DIM works before freeing the memory they live in. tx_dim and rx_dim are embedded in struct idpf_q_vector, they are queued from the NAPI poll via net_dim(), and idpf_vport_intr_rel() ends with kfree(rsrc->q_vectors). Nothing in the driver cancels them. idpf_tx_dim_work() and idpf_rx_dim_work() then run on freed memory: idpf_vport_intr_write_itr() writes the ITR register through q_vector->intr_reg.tx_itr / rx_itr, void __iomem pointers loaded out of the freed q_vector. No configuration is needed to get there -- IDPF_ITR_IS_DYNAMIC() is defined as (itr_mode) and idpf_vport_alloc() initialises both modes to IDPF_ITR_DYNAMIC. Draining after idpf_vport_intr_napi_dis_all() is not enough on its own. idpf_net_dim() is called from inside the "if (napi_complete_done(napi, work_done))" branch of the poll, and napi_complete_done() has already cleared NAPIF_STATE_SCHED by then. napi_disable_locked() waits only while (val & (NAPIF_STATE_SCHED | NAPIF_STATE_NPSVC)), so napi_disable() can return while the poll tail is still queueing the work, and a plain cancel_work_sync() would be re-armed behind the drain. Use disable_work_sync(): schedule_work() on a work with a non-zero disable count is dropped by clear_pending_if_disabled() before __queue_work() is reached. Move idpf_init_dim() to idpf_vport_intr_alloc() so the works are initialised on every path that can reach the drain -- the three "goto intr_deinit" sites between idpf_vport_intr_init() and idpf_vport_intr_ena() get there without the enable side having run. Nothing re-enables them: rsrc->q_vectors is freed on every exit from idpf_vport_open() and on every idpf_vport_stop(), so the count dies with the object. It is a race, not a deterministic failure -- net_dim() only schedules once DIM_NEVENTS events have accumulated and the profile index changes. A KASAN ifup/ifdown loop under load is the way to see it.
02KernelScan AI Analysis
Risk summary
The Intel IDPF network driver frees queue vector memory without first draining or disabling Dynamic Interrupt Moderation (DIM) work items that are scheduled from the NAPI poll path. A local user with network-administration privileges who cycles the interface up and down under network load can win a race causing the DIM work handlers to execute on freed memory, corrupting kernel state and likely crashing the system. Exploitation requires specific Intel network hardware or virtual functions and active network traffic on the interface.
Vulnerability analysis
The Intel IDPF network driver schedules Dynamic Interrupt Moderation work items from its NAPI packet-processing poll routine. When the network interface is torn down, the driver frees the queue vector structures that embed those work items without first canceling or disabling them. Because the poll tail can still be running after the NAPI disable call returns, a work item can be queued on the just-freed memory and then execute, writing to hardware registers through I/O-mapped pointers loaded from the deallocated structure. The fix adds a step that disables and drains each work item before the queue vectors are freed, which both waits for any in-flight work to complete and prevents the poll tail from re-arming it. The race is reachable from a local process that can bring the IDPF interface down while network traffic is flowing, which requires network-administration capability and the presence of specific Intel network hardware or virtual functions.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.12 | 6.7 | 6.12.112 | 7d64d4c6bb6b |
| 6.18 | 6.7 | 6.18.53 | 7e4312953788 |
| 7.2 | 6.7 | 7.2.7 | cd7a1598645b |
| mainline | 6.7 | 7.3-rc3 | 7dd4c829bac2 |