dmaengine: idxd: Remove improper idxd_free

{
  "id": "7aaa70333e484060ad35e8e707a80a89e36688260eda2a30edb6ca6837903e8e",
  "url": "https://osv.dev/vulnerability/CVE-2025-39871",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "dmaengine: idxd: Remove improper idxd_free",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove improper idxd_free The call to idxd_free() introduces a duplicate put_device() leading to a reference count underflow: refcount_t: underflow; use-after-free. WARNING: CPU: 15 PID: 4428 at lib/refcount.c:28 refcount_warn_saturate+0xbe/0x110 ... Call Trace: idxd_remove+0xe4/0x120 [idxd] pci_device_remove+0x3f/0xb0 device_release_driver_internal+0x197/0x200 driver_detach+0x48/0x90 bus_remove_driver+0x74/0xf0 pci_unregister_driver+0x2e/0xb0 idxd_exit_module+0x34/0x7a0 [idxd] __do_sys_delete_module.constprop.0+0x183/0x280 do_syscall_64+0x54/0xd70 entry_SYSCALL_64_after_hwframe+0x76/0x7e The idxd_unregister_devices() which is invoked at the very beginning of idxd_remove(), already takes care of the necessary put_device() through the following call path: idxd_unregister_devices() -> device_unregister() -> put_device() In addition, when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() may trigger asynchronous cleanup via schedule_delayed_work(). If idxd_free() is called immediately after, it can result in a use-after-free. Remove the improper idxd_free() to avoid both the refcount underflow and potential memory corruption during module unload.",
    "evidence": "osv:CVE-2025-39871",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.107",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.48",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.16.8",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2025-39871",
      "aliases": [
        "CVE-2025-39871"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "68ac5a01f635b3791196fd1c39bc48497252c36f"
                },
                {
                  "fixed": "24414bbcb37e1af95190af36c21ae51d497e1a9e"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d2d05fd0fc95c4defed6f7b87550e20e8baa1d97"
                },
                {
                  "fixed": "0e95ee7f532b21206fe3f1c4054002b0d21e3b9c"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "21f9f5cd9a0c75084d4369ba0b8c4f695c41dea7"
                },
                {
                  "fixed": "dd7a7e43269711d757fc260b0bbdf7138f75de11"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "d5449ff1b04dfe9ed8e455769aa01e4c2ccf6805"
                },
                {
                  "fixed": "da4fbc1488a4cec6748da685181ee4449a878dac"
                },
                {
                  "fixed": "f41c538881eec4dcf5961a242097d447f848cda6"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.1.140"
                },
                {
                  "fixed": "6.1.160"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.6.92"
                },
                {
                  "fixed": "6.6.107"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.12.30"
                },
                {
                  "fixed": "6.12.48"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "6.14.8"
                },
                {
                  "fixed": "6.15"
                }
              ]
            },
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "2b7a961cea0e5b65afda911f76d14fec5c98d024"
                }
              ]
            }
          ],
          "versions": [
            "v6.1.159",
            "v6.1.158",
            "v6.1.157",
            "v6.1.156",
            "v6.1.155",
            "v6.1.154",
            "v6.1.153",
            "v6.1.152",
            "v6.1.151",
            "v6.1.150",
            "v6.1.149",
            "v6.1.148",
            "v6.1.147",
            "v6.1.146",
            "v6.1.145",
            "v6.1.144",
            "v6.1.143",
            "v6.1.142",
            "v6.1.141",
            "v6.1.140",
            "v6.6.106",
            "v6.6.105",
            "v6.6.104",
            "v6.6.103",
            "v6.6.102",
            "v6.6.101",
            "v6.6.100",
            "v6.6.99",
            "v6.6.98",
            "v6.6.97",
            "v6.6.96",
            "v6.6.95",
            "v6.6.94",
            "v6.6.93",
            "v6.6.92",
            "v6.12.47",
            "v6.12.46",
            "v6.12.45",
            "v6.12.44",
            "v6.12.43",
            "v6.12.42",
            "v6.12.41",
            "v6.12.40",
            "v6.12.39",
            "v6.12.38",
            "v6.12.37",
            "v6.12.36",
            "v6.12.35",
            "v6.12.34",
            "v6.12.33",
            "v6.12.32",
            "v6.12.31",
            "v6.12.30",
            "v6.14.11",
            "v6.14.10",
            "v6.14.9",
            "v6.14.8"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39871.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "6.1.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.107"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.48"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.16.8"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-39871.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:35.678334141Z",
      "provider": "osv",
      "references": [
        "https://cert-portal.siemens.com/productcert/html/ssa-019113.html",
        "https://cert-portal.siemens.com/productcert/html/ssa-457936.html",
        "https://git.kernel.org/stable/c/0e95ee7f532b21206fe3f1c4054002b0d21e3b9c",
        "https://git.kernel.org/stable/c/24414bbcb37e1af95190af36c21ae51d497e1a9e",
        "https://git.kernel.org/stable/c/da4fbc1488a4cec6748da685181ee4449a878dac",
        "https://git.kernel.org/stable/c/dd7a7e43269711d757fc260b0bbdf7138f75de11",
        "https://git.kernel.org/stable/c/f41c538881eec4dcf5961a242097d447f848cda6",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39871.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-39871",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/39xxx/CVE-2025-39871.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-39871",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 503051,
  "published_at": "2025-09-23T06:00:44.882+00:00"
}