In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Remove improper idxd_free
The call to idxdfree() introduces a duplicate putdevice() leading to a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcountwarnsaturate+0xbe/0x110 ... Call Trace: <TASK> idxdremove+0xe4/0x120 [idxd] pcideviceremove+0x3f/0xb0 devicereleasedriverinternal+0x197/0x200 driverdetach+0x48/0x90 busremovedriver+0x74/0xf0 pciunregisterdriver+0x2e/0xb0 idxdexitmodule+0x34/0x7a0 [idxd] _dosysdeletemodule.constprop.0+0x183/0x280 dosyscall64+0x54/0xd70 entrySYSCALL64afterhwframe+0x76/0x7e
The idxdunregisterdevices() which is invoked at the very beginning of idxdremove(), already takes care of the necessary putdevice() through the following call path: idxdunregisterdevices() -> deviceunregister() -> putdevice()
In addition, when CONFIGDEBUGKOBJECTRELEASE is enabled, putdevice() may trigger asynchronous cleanup via scheduledelayedwork(). If idxd_free() is called immediately after, it can result in a use-after-free.
Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload.
[
{
"signature_type": "Line",
"id": "CVE-2025-39871-4435b635",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e95ee7f532b21206fe3f1c4054002b0d21e3b9c",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94356697486722788102805826340456226641",
"271250639997383534107995406018050195689",
"312251668387773506704177162360013982272",
"216447057216171301271667959208151106354"
]
}
},
{
"signature_type": "Function",
"id": "CVE-2025-39871-456f6e6a",
"target": {
"function": "idxd_remove",
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da4fbc1488a4cec6748da685181ee4449a878dac",
"digest": {
"function_hash": "260915130407822602340790732989679698896",
"length": 331.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-39871-5a4ea1dd",
"target": {
"function": "idxd_remove",
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd7a7e43269711d757fc260b0bbdf7138f75de11",
"digest": {
"function_hash": "260915130407822602340790732989679698896",
"length": 331.0
}
},
{
"signature_type": "Function",
"id": "CVE-2025-39871-727af791",
"target": {
"function": "idxd_remove",
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f41c538881eec4dcf5961a242097d447f848cda6",
"digest": {
"function_hash": "260915130407822602340790732989679698896",
"length": 331.0
}
},
{
"signature_type": "Line",
"id": "CVE-2025-39871-783dca97",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@dd7a7e43269711d757fc260b0bbdf7138f75de11",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94356697486722788102805826340456226641",
"271250639997383534107995406018050195689",
"312251668387773506704177162360013982272",
"216447057216171301271667959208151106354"
]
}
},
{
"signature_type": "Line",
"id": "CVE-2025-39871-c6200c01",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@da4fbc1488a4cec6748da685181ee4449a878dac",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94356697486722788102805826340456226641",
"271250639997383534107995406018050195689",
"312251668387773506704177162360013982272",
"216447057216171301271667959208151106354"
]
}
},
{
"signature_type": "Line",
"id": "CVE-2025-39871-df84fd76",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f41c538881eec4dcf5961a242097d447f848cda6",
"digest": {
"threshold": 0.9,
"line_hashes": [
"94356697486722788102805826340456226641",
"271250639997383534107995406018050195689",
"312251668387773506704177162360013982272",
"216447057216171301271667959208151106354"
]
}
},
{
"signature_type": "Function",
"id": "CVE-2025-39871-e18140e1",
"target": {
"function": "idxd_remove",
"file": "drivers/dma/idxd/init.c"
},
"signature_version": "v1",
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0e95ee7f532b21206fe3f1c4054002b0d21e3b9c",
"digest": {
"function_hash": "260915130407822602340790732989679698896",
"length": 331.0
}
}
]