linux-cve-announce - CVE-2025-39871: dmaengine: idxd: Remove improper idxd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2025092300-CVE-2025-39871-3abe@gregkh>
Date: Tue, 23 Sep 2025 08:01:02 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...nel.org>
Subject: CVE-2025-39871: dmaengine: idxd: Remove improper idxd_free

From: Greg Kroah-Hartman <gregkh@...nel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: idxd: Remove improper idxd_free

The call to idxd_free() introduces a duplicate put_device() leading to a
reference count underflow:
refcount_t: underflow; use-after-free.
WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110
...
Call Trace:
 <TASK>
  idxd_remove+0xe4/0x120 [idxd]
  pci_device_remove+0x3f/0xb0
  device_release_driver_internal+0x197/0x200
  driver_detach+0x48/0x90
  bus_remove_driver+0x74/0xf0
  pci_unregister_driver+0x2e/0xb0
  idxd_exit_module+0x34/0x7a0 [idxd]
  __do_sys_delete_module.constprop.0+0x183/0x280
  do_syscall_64+0x54/0xd70
  entry_SYSCALL_64_after_hwframe+0x76/0x7e

The idxd_unregister_devices() which is invoked at the very beginning of
idxd_remove(), already takes care of the necessary put_device() through the
following call path:
idxd_unregister_devices() -> device_unregister() -> put_device()

In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may
trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is
called immediately after, it can result in a use-after-free.

Remove the improper idxd_free() to avoid both the refcount underflow and
potential memory corruption during module unload.

The Linux kernel CVE team has assigned CVE-2025-39871 to this issue.

Affected and fixed versions
===========================

	Issue introduced in 6.6.92 with commit d2d05fd0fc95c4defed6f7b87550e20e8baa1d97 and fixed in 6.6.107 with commit 0e95ee7f532b21206fe3f1c4054002b0d21e3b9c
	Issue introduced in 6.12.30 with commit 21f9f5cd9a0c75084d4369ba0b8c4f695c41dea7 and fixed in 6.12.48 with commit dd7a7e43269711d757fc260b0bbdf7138f75de11
	Issue introduced in 6.15 with commit d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805 and fixed in 6.16.8 with commit da4fbc1488a4cec6748da685181ee4449a878dac
	Issue introduced in 6.15 with commit d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805 and fixed in 6.17-rc6 with commit f41c538881eec4dcf5961a242097d447f848cda6
	Issue introduced in 6.1.140 with commit 68ac5a01f635b3791196fd1c39bc48497252c36f
	Issue introduced in 6.14.8 with commit 2b7a961cea0e5b65afda911f76d14fec5c98d024

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2025-39871
will be updated if fixes are backported, please check that for the most
up to date information about this issue.

Affected files
==============

The file(s) affected by this issue are:
	drivers/dma/idxd/init.c

Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0e95ee7f532b21206fe3f1c4054002b0d21e3b9c
	https://git.kernel.org/stable/c/dd7a7e43269711d757fc260b0bbdf7138f75de11
	https://git.kernel.org/stable/c/da4fbc1488a4cec6748da685181ee4449a878dac
	https://git.kernel.org/stable/c/f41c538881eec4dcf5961a242097d447f848cda6