Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-39871— dmaengine: idxd: Remove improper idxd_free

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于idxd_free函数中存在不恰当的引用计数操作，可能导致释放后重用。

AI Predicted 5.5 Difficulty: Moderate EPSS 0.15% · P4

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 17

VendorProduct Version RangeStatus
Linux Linux 68ac5a01f635b3791196fd1c39bc48497252c36f< 24414bbcb37e1af95190af36c21ae51d497e1a9e affected
d2d05fd0fc95c4defed6f7b87550e20e8baa1d97< 0e95ee7f532b21206fe3f1c4054002b0d21e3b9c affected
21f9f5cd9a0c75084d4369ba0b8c4f695c41dea7< dd7a7e43269711d757fc260b0bbdf7138f75de11 affected
d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805< da4fbc1488a4cec6748da685181ee4449a878dac affected
d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805< f41c538881eec4dcf5961a242097d447f848cda6 affected
2b7a961cea0e5b65afda911f76d14fec5c98d024 affected
6.1.140< 6.1.160 affected
6.6.92< 6.6.107 affected
… +9 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-39871

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
dmaengine: idxd: Remove improper idxd_free
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: <TASK> idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于idxd_free函数中存在不恰当的引用计数操作，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 68ac5a01f635b3791196fd1c39bc48497252c36f ~ 24414bbcb37e1af95190af36c21ae51d497e1a9e -
Linux Linux 6.15 -

II. Public POCs for CVE-2025-39871

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-39871

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-09-23 · 21 CVEs total

CVE-2025-39880 9.8 CRITICAL libceph: fix invalid accesses to ceph_connection_v1_info
CVE-2025-39869 8.4 HIGH dmaengine: ti: edma: Fix memory allocation size for queue_priority_map
CVE-2025-39882 8.4 HIGH drm/mediatek: fix potential OF node use-after-free
CVE-2025-39872 7.8 HIGH hsr: hold rcu and dev lock for hsr_get_port_ndev
CVE-2025-39873 7.8 HIGH can: xilinx_can: xcan_write_frame(): fix use-after-free of transmitted SKB
CVE-2025-39888 7.8 HIGH fuse: Block access to folio overlimit
CVE-2025-39868 7.8 HIGH erofs: fix runtime warning on truncate_folio_batch_exceptionals()
CVE-2025-39881 7.8 HIGH kernfs: Fix UAF in polling when open file is released
CVE-2025-39878 ceph: fix crash after fscrypt_encrypt_pagecache_blocks() error
CVE-2025-39887 tracing/osnoise: Fix null-ptr-deref in bitmap_parselist()
CVE-2025-39885 ocfs2: fix recursive semaphore deadlock in fiemap call
CVE-2025-39886 bpf: Tell memcg to use allow_spinning=false path in bpf_timer_init()
CVE-2025-39883 mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory
CVE-2025-39884 btrfs: fix subvolume deletion lockup caused by inodes xarray race
CVE-2025-39879 ceph: always call ceph_shift_unused_folios_left()
CVE-2025-39877 mm/damon/sysfs: fix use-after-free in state_show()
CVE-2025-39876 net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable()
CVE-2025-39874 macsec: sync features on RTM_NEWLINK
CVE-2025-39875 igb: Fix NULL pointer dereference in ethtool loopback test
CVE-2025-39870 dmaengine: idxd: Fix double free in idxd_setup_wqs()

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-39871

No comments yet

Leave a comment