CVE-2025-39871
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-09-23

Last updated on: 2025-12-12

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: <TASK> idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-09-23
Last Modified
2025-12-12
Generated
2026-06-16
AI Q&A
2025-09-23
EPSS Evaluated
2026-06-15
NVD
CVE-2025-39871
Affected Vendors & Products
Showing 12 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.1.140 (inc) to 6.2 (exc)
linux linux_kernel From 6.6.92 (inc) to 6.6.107 (exc)
linux linux_kernel From 6.12.30 (inc) to 6.12.48 (exc)
linux linux_kernel From 6.14.8 (inc) to 6.15 (exc)
linux linux_kernel From 6.15.1 (inc) to 6.16.8 (exc)
linux linux_kernel 6.15
linux linux_kernel 6.15
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
linux linux_kernel 6.17
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's dmaengine idxd driver involves an improper call to idxd_free(), which causes a duplicate put_device() call. This leads to a reference count underflow, resulting in a use-after-free condition. Essentially, the device's reference count is decremented too many times, potentially causing memory corruption or crashes during module unload.

Impact Analysis

The impact of this vulnerability includes potential memory corruption and use-after-free errors during the unloading of the idxd kernel module. This can lead to system instability, crashes, or security issues due to improper memory handling.

Detection Guidance

This vulnerability can be detected by monitoring kernel logs for refcount underflow warnings related to idxd_free, such as messages containing 'refcount_t: underflow; use-after-free' or warnings from refcount_warn_saturate. You can check the kernel log using commands like 'dmesg | grep refcount' or 'journalctl -k | grep refcount'.

Mitigation Strategies

The immediate mitigation is to update the Linux kernel to a version where the improper idxd_free() call has been removed, as this fix prevents the reference count underflow and potential use-after-free issues during module unload. If updating is not immediately possible, avoid unloading the idxd module to prevent triggering the vulnerability.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-39871. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart