CVE-2025-39871: dmaengine: idxd: Remove improper idxd_free
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Remove improper idxdfree
The call to idxdfree() introduces a duplicate putdevice() leading to a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcountwarnsaturate+0xbe/0x110 ... Call Trace: <TASK> idxdremove+0xe4/0x120 [idxd] pcideviceremove+0x3f/0xb0 devicereleasedriverinternal+0x197/0x200 driverdetach+0x48/0x90 busremovedriver+0x74/0xf0 pciunregisterdriver+0x2e/0xb0 idxdexitmodule+0x34/0x7a0 [idxd] dosysdeletemodule.constprop.0+0x183/0x280 dosyscall64+0x54/0xd70 entrySYSCALL64afterhwframe+0x76/0x7e
The idxdunregisterdevices() which is invoked at the very beginning of idxdremove(), already takes care of the necessary putdevice() through the following call path: idxdunregisterdevices() -> deviceunregister() -> putdevice()
In addition, when CONFIGDEBUGKOBJECTRELEASE is enabled, putdevice() may trigger asynchronous cleanup via scheduledelayedwork(). If idxdfree() is called immediately after, it can result in a use-after-free.
Remove the improper idxdfree() to avoid both the refcount underflow and potential memory corruption during module unload.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39871?
CVE-2025-39871 is classified as a medium severity vulnerability due to the potential for a use-after-free condition.
How do I fix CVE-2025-39871?
To fix CVE-2025-39871, update your Linux kernel to a version that includes the patch addressing the idxd_free() call.
What systems are affected by CVE-2025-39871?
CVE-2025-39871 affects the Linux kernel, particularly systems utilizing the dmaengine subsystem.
What are the potential consequences of CVE-2025-39871?
The consequences of CVE-2025-39871 include possible system crashes and exploitation due to reference count underflow.
Is CVE-2025-39871 vulnerable to exploitation?
Yes, CVE-2025-39871 can potentially be exploited through crafted inputs that trigger the use-after-free condition.