In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Prevent use after free on completion memory On driver unload any pending descriptors are flushed at the time the interrupt is freed: idxddmaenginedrvremove() -> drvdisablewq() -> idxdwqfreeirq() -> idxdflushpendingdescs(). If there are any descriptors present that need to be flushed this flow triggers a "not present" page fault as below: BUG: unable to handle page fault for address: ff391c97c70c9040 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page The address that triggers the fault is the address of the descriptor that was freed moments earlier via: drvdisablewq()->idxdwqfreeresources() Fix the use after free by freeing the descriptors after any possible usage. This is done after idxdwq_reset() to ensure that the memory remains accessible during possible completion writes by the device.