CVE-2025-39871: dmaengine: idxd: Remove improper idxd_free

Published Sep 23, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Remove improper idxdfree

The call to idxdfree() introduces a duplicate putdevice() leading to a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcountwarnsaturate+0xbe/0x110 ... Call Trace: <TASK> idxdremove+0xe4/0x120 [idxd] pcideviceremove+0x3f/0xb0 devicereleasedriverinternal+0x197/0x200 driverdetach+0x48/0x90 busremovedriver+0x74/0xf0 pciunregisterdriver+0x2e/0xb0 idxdexitmodule+0x34/0x7a0 [idxd] dosysdeletemodule.constprop.0+0x183/0x280 dosyscall64+0x54/0xd70 entrySYSCALL64afterhwframe+0x76/0x7e

The idxdunregisterdevices() which is invoked at the very beginning of idxdremove(), already takes care of the necessary putdevice() through the following call path: idxdunregisterdevices() -> deviceunregister() -> putdevice()

In addition, when CONFIGDEBUGKOBJECTRELEASE is enabled, putdevice() may trigger asynchronous cleanup via scheduledelayedwork(). If idxdfree() is called immediately after, it can result in a use-after-free.

Remove the improper idxdfree() to avoid both the refcount underflow and potential memory corruption during module unload.

Affected Software

13 affected components
Linux Linux kernel
Linux Linux kernel>=6.1.140<6.2
Linux Linux kernel>=6.6.92<6.6.107
Linux Linux kernel>=6.12.30<6.12.48
Linux Linux kernel>=6.14.8<6.15
Linux Linux kernel>=6.15.1<6.16.8
Linux Linux kernel=6.15
Linux Linux kernel=6.15-rc7
Linux Linux kernel=6.17-rc1
Linux Linux kernel=6.17-rc2
Linux Linux kernel=6.17-rc3
Linux Linux kernel=6.17-rc4
Linux Linux kernel=6.17-rc5

Event History

Sep 23, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
Description
Data Sourced
via NVD·06:15 AM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2025-39871?

CVE-2025-39871 is classified as a medium severity vulnerability due to the potential for a use-after-free condition.

2

How do I fix CVE-2025-39871?

To fix CVE-2025-39871, update your Linux kernel to a version that includes the patch addressing the idxd_free() call.

3

What systems are affected by CVE-2025-39871?

CVE-2025-39871 affects the Linux kernel, particularly systems utilizing the dmaengine subsystem.

4

What are the potential consequences of CVE-2025-39871?

The consequences of CVE-2025-39871 include possible system crashes and exploitation due to reference count underflow.

5

Is CVE-2025-39871 vulnerable to exploitation?

Yes, CVE-2025-39871 can potentially be exploited through crafted inputs that trigger the use-after-free condition.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203