huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-37823: kernel: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-08T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too

Similarly to the previous patch, we need to safe guard hfsc_dequeue()
too. But for this one, we don't have a reliable reproducer.


Affected upstream versions: 2.6.12
Fixed upstream versions: 0, 5.10.237, 5.15.181, 5.4.293, 6.1.136, 6.12.26, 6.14.5, 6.15, 6.6.89
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 68f256305ceb426d545a0dc31f83c2ab1d211a1e
CVE-2025-37825: kernel: nvmet: fix out-of-bounds access in nvmet_enable_port
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-08T00:00:00+00:00

An out-of-bounds access vulnerability was found in the Linux kernel's nvme subsystem in the `nvmet_enable_port()` function. The vulnerability can occur when a port is enabled without a transport type configured, causing the function to use the `NVMF_TRTYPE_MAX` value (255) as an array index into the `nvmet_transports` structure. The out-of-bounds read can lead to system instability, information leakage, and a denial of service.


Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.14.5, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 83c00860a37b3fcba8026cb344101f1b8af547cf
CVE-2025-37849: kernel: KVM: arm64: Tear down vGIC on failed vCPU creation
Component: kernel
Severity: Moderate
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-09T00:00:00+00:00

A use-after-free flaw was found in KVM for arm64 in the Linux Kernel, if the kvm_arch_vcpu_create() fails to share the vCPU page with the
hypervisor. This vulnerability could even lead to a kernel information leak problem.

Statement: A use-after-free may be observed in kvm_arch_vcpu_create in arch/arm64/kvm/arm.c in the Linux Kernel ARM64 KVM, due to a missing error handling when the vCPU is destroyed. This vulnerability could even lead to a kernel information leak problem, and a UAF if redistributor device handling tries to walk into the vCPU with an added speculation (AC:H).

Affected upstream versions: 3.11
Fixed upstream versions: 0, 6.1.135, 6.12.24, 6.13.12, 6.14.3, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 07476e0d932afc53c05468076393ac35d0b4999e
CVE-2025-37861: kernel: scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue

When the task management thread processes reply queues while the reset
thread resets them, the task management thread accesses an invalid queue ID
(0xFFFF), set by the reset thread, which points to unallocated memory,
causing a crash.

Add flag 'io_admin_reset_sync' to synchronize access between the reset,
I/O, and admin threads. Before a reset, the reset handler sets this flag to
block I/O and admin processing threads. If any thread bypasses the initial
check, the reset thread waits up to 10 seconds for processing to finish. If
the wait exceeds 10 seconds, the controller is marked as unrecoverable.

Statement: This Moderate impact flaw in the Linux kernel's `mpi3mr` SCSI driver module. In this flaw a local attacker with a special group privilege leads to a system crash due to a synchronization problem during a resets the controller's operations. With the available usecase, this flaw does not cause to an integrate threat.

Affected upstream versions: 5.14
Fixed upstream versions: 0, 6.12.24, 6.13.12, 6.14.3, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 65ba18c84dbd03afe9b38c06c151239d97a09834
CVE-2025-37869: kernel: drm/xe: Use local fence in error path of xe_migrate_clear
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.8 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2025-05-09T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/xe: Use local fence in error path of xe_migrate_clear

The intent of the error path in xe_migrate_clear is to wait on locally
generated fence and then return. The code is waiting on m->fence which
could be the local fence but this is only stable under the job mutex
leading to a possible UAF. Fix code to wait on local fence.

(cherry picked from commit 762b7e95362170b3e13a8704f38d5e47eca4ba74)

Statement: The bug actual only for latest version of Red Hat Enterprise Linux 9 and Red Hat Enterprise Linux 10 (and only if driver for Intel Xe series GPUs being used). It could happen on error path that would complex to trigger. The attack complexity is high.

Affected upstream versions: 6.8
Fixed upstream versions: 0, 6.12.25, 6.14.4, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2ac5f466f62892a7d1ac2d1a3eb6cd14efbe2f2d
CVE-2025-37882: kernel: Linux kernel: xHCI driver isochronous event handling race condition leading to data loss or UAF
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-05-09T00:00:00+00:00

A flaw was found in the Linux kernel's xHCI (eXtensible Host Controller Interface) driver. This vulnerability allows data loss or buffer Use-After-Free (UAF) due to a race condition during isochronous Ring Underrun/Overrun event handling.

Statement: This Moderate impact flaw in the Linux kernel's xHCI driver can lead to data loss or Use-After-Free conditions due to a race condition during isochronous event handling by an local attacker with a special privilege. This affects Red Hat Enterprise Linux systems utilizing USB 3.0 host controllers. Exploitation requires interaction with xHCI devices.

Affected upstream versions: 6.10
Fixed upstream versions: 0, 6.12.26, 6.14.5, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 16a7a8e6c47fea5c847beb696c8c21a7a44c1915
CVE-2025-37890: kernel: net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-16T00:00:00+00:00

A use-after-free vulnerability has been identified in the Linux kernel's HFSC (Hierarchical Fair Service Curve) queuing discipline when it is configured with NETEM (Network Emulation) as a child. This flaw can lead to a kernel panic or crash due to incorrect assumptions about the queue state.

Exploitation of this vulnerability requires local access with CAP_NET_ADMIN privileges and control over the qdisc (queueing discipline) setup. A local attacker could leverage this flaw to achieve denial of service or escalate privileges. Given that it affects kernel memory structures, successful exploitation could result in memory corruption, data leaks, or arbitrary write capabilities, leading to a full kernel crash.

Statement: On Red Hat Enterprise Linux 8 and later releases, regular (non-root) users can exploit this issue by abusing unprivileged user namespaces. Red Hat Enterprise Linux 6 and 7 are not affected by this CVE because they did not include the upstream commit that introduced the CVE (37d9cf1).

Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.238, 5.15.182, 5.4.294, 6.1.138, 6.12.28, 6.14.6, 6.15, 6.6.90
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 273bbcfa53541cde38b2003ad88a59b770306421
CVE-2025-37891: kernel: Linux kernel: ALSA: ump buffer overflow via malformed UMP SysEx message
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-05-19T00:00:00+00:00

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Universal MIDI Packet (UMP) driver. This vulnerability allows a buffer overflow and potential memory corruption via a malformed Universal MIDI Packet (UMP) System Exclusive (SysEx) message during MIDI 1.0 to UMP conversion.

Statement: MODERATE: A vulnerability in the Linux kernel's ALSA Universal MIDI Packet (UMP) driver could lead to a memory corruption due to a buffer overflow problem. This vulnerability occurs during MIDI to UMP conversion when processing a malformed UMP System Exclusive (SysEx) message. In this flaw a local attacker with normal user privilege may cause a random memory corruption which may lead to a denial of service (DoS).

Affected upstream versions: 6.5
Fixed upstream versions: 0, 6.12.28, 6.14.6, 6.15, 6.6.90
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ce4f77bef276e7d2eb7ab03a5d08bcbaa40710ec
CVE-2025-37914: kernel: net_sched: ets: Fix double list add in class with netem as child qdisc
Component: kernel
Severity: Moderate
CWE: CWE-123 (Write-what-where Condition)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-20T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel’s `netem` qdisc. This issue occurs when it incorrectly manages duplicated packets in classful parent qdiscs. This leads to a corrupted internal state and eventual dereferencing of freed memory, resulting in unpredictable behavior, system instability, or a crash.

Statement: A logic flaw in the ETS (Enhanced Transmission Selection) scheduler in the Linux kernel’s net/sched subsystem allows the same class to be added twice to the active list if the enqueue callback is reentered, for example due to a netem child.

Although no UAF occurs, this leads to list corruption, which may result in kernel memory corruption, undefined behavior, or system crashes.

Triggering this bug requires a crafted qdisc hierarchy and interaction between ETS and netem.

An attacker could create memory corruption via list pointers, but turning this into privilege escalation would require further primitives or info leaks.

Likely exploitable for denial-of-service (DoS) in most practical scenarios.

Affected upstream versions: 5.6
Fixed upstream versions: 0, 5.10.238, 5.15.182, 6.1.138, 6.12.28, 6.14.6, 6.15, 6.6.90
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 24388ba0a1b1b6d4af1b205927ac7f7b119ee4ea
CVE-2025-37943: kernel: wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi
Component: kernel
Severity: Important
CWE: CWE-253 (Incorrect Check of Function Return Value)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-20T00:00:00+00:00

A flaw was discovered in the Linux kernel's driver for Qualcomm Atheros Wi-fi 7 driver (ath12k). An attacker with the ability to generate real or simulated network traffic could exploit this vulnerability to modify kernel memory, leading to a denial of service, compromised system integrity, or an elevation of privileges.

Statement: This vulnerability in the ath12k driver can be exploited when hardware which uses that driver provides malformed packets, specifically packets with a header length longer than permitted by the Wi-Fi specification. An attacker who can generate packets to be processed by this driver could exploit this flaw to alter kernel memory, resulting in the ability to escalate their privileges or otherwise compromise system integrity and stability.

These drivers are not included in Red Hat Enterprise Linux prior to 9.6, so those systems are unaffected.

Affected upstream versions: 6.3
Fixed upstream versions: 0, 6.12.24, 6.13.12, 6.14.3, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7f1d986da5c6abb75ffe4d0d325fc9b341c41a1c
CVE-2025-37958: kernel: mm/huge_memory: fix dereferencing invalid pmd migration entry
Component: kernel
Severity: Moderate
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/huge_memory: fix dereferencing invalid pmd migration entry

When migrating a THP, concurrent access to the PMD migration entry during
a deferred split scan can lead to an invalid address access, as
illustrated below.  To prevent this invalid access, it is necessary to
check the PMD migration entry and return early.  In this context, there is
no need to use pmd_to_swp_entry and pfn_swap_entry_to_page to verify the
equality of the target folio.  Since the PMD migration entry is locked, it
cannot be served as the target.

Mailing list discussion and explanation from Hugh Dickins: "An anon_vma
lookup points to a location which may contain the folio of interest, but
might instead contain another folio: and weeding out those other folios is
precisely what the "folio != pmd_folio((*pmd)" check (and the "risk of
replacing the wrong folio" comment a few lines above it) is for."

BUG: unable to handle page fault for address: ffffea60001db008
CPU: 0 UID: 0 PID: 2199114 Comm: tee Not tainted 6.14.0+ #4 NONE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:split_huge_pmd_locked+0x3b5/0x2b60
Call Trace:
<TASK>
try_to_migrate_one+0x28c/0x3730
rmap_walk_anon+0x4f6/0x770
unmap_folio+0x196/0x1f0
split_huge_page_to_list_to_order+0x9f6/0x1560
deferred_split_scan+0xac5/0x12a0
shrinker_debugfs_scan_write+0x376/0x470
full_proxy_write+0x15c/0x220
vfs_write+0x2fc/0xcb0
ksys_write+0x146/0x250
do_syscall_64+0x6a/0x120
entry_SYSCALL_64_after_hwframe+0x76/0x7e

The bug is found by syzkaller on an internal kernel, then confirmed on
upstream.

Statement: Local DoS via page fault in THP migration edge case. Requires aggressive memory operations and THP. No remote or privilege escalation risk.

Affected upstream versions: 4.14
Fixed upstream versions: 0, 5.10.239, 5.15.186, 5.4.295, 6.1.142, 6.12.29, 6.14.7, 6.15, 6.6.95
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 753f142f7ff7d2223a47105b61e1efd91587d711
CVE-2025-37980: kernel: block: fix resource leak in blk_register_queue() error path
Component: kernel
Severity: Low
CWE: CWE-459 (Incomplete Cleanup)
CVSS v3: 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

block: fix resource leak in blk_register_queue() error path

When registering a queue fails after blk_mq_sysfs_register() is
successful but the function later encounters an error, we need
to clean up the blk_mq_sysfs resources.

Add the missing blk_mq_sysfs_unregister() call in the error path
to properly clean up these resources and prevent a memory leak.


Affected upstream versions: 3.13
Fixed upstream versions: 0, 6.1.168, 6.12.25, 6.14.4, 6.15, 6.6.88
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 6af6d5feebf9423ab3b252831d1f52de31a8b5e0
CVE-2025-37994: kernel: usb: typec: ucsi: displayport: Fix NULL pointer access
Component: kernel
Severity: Moderate
CVSS v3: 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-29T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

usb: typec: ucsi: displayport: Fix NULL pointer access

This patch ensures that the UCSI driver waits for all pending tasks in the
ucsi_displayport_work workqueue to finish executing before proceeding with
the partner removal.


Affected upstream versions: 5.2
Fixed upstream versions: 0, 5.10.238, 5.15.183, 5.4.294, 6.1.139, 6.12.29, 6.14.7, 6.15, 6.6.91
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 9dda1e2a666a8a32ce0f153b5dee05c7351f1020
CVE-2025-38000: kernel: sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue()
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-06T00:00:00+00:00

A flaw was found in the HFSC queueing discipline implementation in the Linux kernel. When a packet is enqueued and the child qdisc's peek() function is called before properly updating the HFSC queue's length and backlog counters, a race condition can occur. In some cases, the peek operation may trigger an immediate dequeue and drop, leading to inconsistent queue accounting. This may leave an empty HFSC class in the active list, eventually causing use-after-free (UAF) conditions. Due to the nature of this memory corruption (use-after-free or list corruption) in kernel scheduler code, a successful exploit could lead to privilege escalation, data leakage, or denial of service. Therefore, the CIA impact is assessed as HHH to reflect a worst-case.

Statement: On Red Hat Enterprise Linux 8 and later releases, regular (non-root) users can exploit this issue by abusing unprivileged user namespaces. On Red Hat Enterprise Linux 7, unprivileged user namespaces are disabled by default. Red Hat Enterprise Linux 6 did not include support for them at all, meaning that root privileges are necessary to trigger this flaw.

Affected upstream versions: 4.8
Fixed upstream versions: 0, 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.31, 6.14.9, 6.15, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 1034e3310752e8675e313f7271b348914008719a
CVE-2025-38001: kernel: net_sched: hfsc: Address reentrant enqueue adding class to eltree twice
Component: kernel
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-06T00:00:00+00:00

A use-after-free (UAF) vulnerability, which also presents a potential infinite loop condition, has been resolved in the Linux kernel. This flaw affects the HFSC (Hierarchical Fair Service Curve) queuing discipline when it is used in conjunction with NETEM (Network Emulation).

A malicious user could exploit this by repeatedly inserting a class into the eltree due to insufficient validation in prior logic, effectively bypassing the protection provided by the HFSC_RSC flag. Successful exploitation could lead to memory corruption, an infinite loop, or a system crash, severely impacting network availability and system stability.

Statement: On Red Hat Enterprise Linux 8 and later releases, regular (non-root) users can exploit this issue by abusing unprivileged user namespaces. Red Hat Enterprise Linux 6 and 7 are not affected by this CVE because they did not include the upstream commit that introduced the CVE (37d9cf1).

Affected upstream versions: 5.0
Fixed upstream versions: 0, 5.10.238, 5.15.185, 5.4.294, 6.1.141, 6.12.32, 6.14.10, 6.15.1, 6.16, 6.6.93
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: e5bee633cc276410337d54b99f77fbc1ad8801e5
CVE-2025-38012: kernel: sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator
Component: kernel
Severity: Moderate
CWE: CWE-824 (Access of Uninitialized Pointer)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

sched_ext: bpf_iter_scx_dsq_new() should always initialize iterator

BPF programs may call next() and destroy() on BPF iterators even after new()
returns an error value (e.g. bpf_for_each() macro ignores error returns from
new()). bpf_iter_scx_dsq_new() could leave the iterator in an uninitialized
state after an error return causing bpf_iter_scx_dsq_next() to dereference
garbage data. Make bpf_iter_scx_dsq_new() always clear $kit->dsq so that
next() and destroy() become noops.


Affected upstream versions: 6.12
Fixed upstream versions: 0, 6.12.30, 6.14.8, 6.15
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0102989af4c334d1d98b2a0fd4d61a5152e39b72
CVE-2025-38013: kernel: wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request
Component: kernel
Severity: Moderate
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request

Make sure that n_channels is set after allocating the
struct cfg80211_registered_device::int_scan_req member. Seen with
syzkaller:

UBSAN: array-index-out-of-bounds in net/mac80211/scan.c:1208:5
index 0 is out of range for type 'struct ieee80211_channel *[] __counted_by(n_channels)' (aka 'struct ieee80211_channel *[]')

This was missed in the initial conversions because I failed to locate
the allocation likely due to the "sizeof(void *)" not matching the
"channels" array type.


Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.12.30, 6.14.8, 6.15, 6.6.92
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: fde33ab3c052a302ee8a0b739094b88ceae4dd67
CVE-2025-38015: kernel: dmaengine: idxd: fix memory leak in error handling path of idxd_alloc
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: fix memory leak in error handling path of idxd_alloc

Memory allocated for idxd is not freed if an error occurs during
idxd_alloc(). To fix it, free the allocated memory in the reverse order
of allocation before exiting the function in case of an error.


Affected upstream versions: 6.0.9 < 6.1, 6.1
Fixed upstream versions: 0, 6.1, 6.1.140, 6.12.30, 6.14.8, 6.15, 6.6.92
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 64afd9a1f644b27661420257dcc007d5009c99dd