CVE-2025-39871— dmaengine: idxd: Remove improper idxd_free
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-39871
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
dmaengine: idxd: Remove improper idxd_free
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: <TASK> idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于idxd_free函数中存在不恰当的引用计数操作，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2025-39871
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-39871
请登录查看更多情报信息。
Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total
| CVE-2025-39878 | ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error | |
| CVE-2025-39887 | tracing/osnoise: Fix null-ptr-deref in bitmap_parselist() | |
| CVE-2025-39888 | fuse: Block access to folio overlimit | |
| CVE-2025-39885 | ocfs2: fix recursive semaphore deadlock in fiemap call | |
| CVE-2025-39886 | bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init() | |
| CVE-2025-39883 | mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory | |
| CVE-2025-39884 | btrfs: fix subvolume deletion lockup caused by inodes xarray race | |
| CVE-2025-39882 | drm/mediatek: fix potential OF node use-after-free | |
| CVE-2025-39880 | libceph: fix invalid accesses to ceph_connection_v1_info | |
| CVE-2025-39881 | kernfs: Fix UAF in polling when open file is released | |
| CVE-2025-39868 | erofs: fix runtime warning on truncate_folio_batch_exceptionals() | |
| CVE-2025-39879 | ceph: always call ceph_shift_unused_folios_left() | |
| CVE-2025-39877 | mm/damon/sysfs: fix use-after-free in state_show() | |
| CVE-2025-39876 | net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() | |
| CVE-2025-39874 | macsec: sync features on RTM_NEWLINK | |
| CVE-2025-39875 | igb: Fix NULL pointer dereference in ethtool loopback test | |
| CVE-2025-39873 | can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB | |
| CVE-2025-39872 | hsr: hold rcu and dev lock for hsr_get_port_ndev | |
| CVE-2025-39869 | dmaengine: ti: edma: Fix memory allocation size for queue_priority_map | |
| CVE-2025-39870 | dmaengine: idxd: Fix double free in idxd_setup_wqs() |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2025-39871
No comments yet