CVE-2025-39871

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Remove improper idxd_free

The call to idxd_free() introduces a duplicate put_device() leading to a

reference count underflow:

refcount_t: underflow; use-after-free.

WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110

...

Call Trace:

<TASK>

idxd_remove+0xe4/0x120 [idxd]

pci_device_remove+0x3f/0xb0

device_release_driver_internal+0x197/0x200

driver_detach+0x48/0x90

bus_remove_driver+0x74/0xf0

pci_unregister_driver+0x2e/0xb0

idxd_exit_module+0x34/0x7a0 [idxd]

__do_sys_delete_module.constprop.0+0x183/0x280

do_syscall_64+0x54/0xd70

entry_SYSCALL_64_after_hwframe+0x76/0x7e

The idxd_unregister_devices() which is invoked at the very beginning of

idxd_remove(), already takes care of the necessary put_device() through the

following call path:

idxd_unregister_devices() -> device_unregister() -> put_device()

In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is ena

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References