July 2026 Patch Tuesday [CVE-2026-58629] Freeing the Wrong Allocation: a double-free in dxgkrnl’s CreateAllocation rollback
Published:
I went into dxgkrnl looking at the usual suspects: the escape paths, the sync-object handlers, anywhere a count from user mode drives a copy. What I didn’t expect was to find the bug in an error handler, in code that only runs when a D3DKMTCreateAllocation call has already half-succeeded and something downstream trips. The rollback that’s supposed to undo a partial create instead reads an allocation handle back out of user memory and frees whatever it points at, with no check that it’s the allocation the call actually made. Point it at a different object you own and the kernel frees that one instead. Get the timing right on a second read and it frees the same object twice.