CVE-2025-38014

What it actually does

Missing put_device() calls for idxd groups, engines, and wqs during remove operations create reference count imbalances that can result in use-after-free conditions within the dmaengine idxd driver.

Why it matters to the business

Unpatched kernels expose systems using Intel DSA hardware to local privilege escalation or denial of service, raising operational risk on servers and endpoints until distribution updates are deployed.

How an attack unfolds

An attacker with local access triggers idxd device removal or cleanup paths, exploiting the absent reference decrements to obtain dangling pointers that are then leveraged for memory corruption and privilege escalation, consistent with observed Linux kernel attack patterns from groups targeting similar driver flaws.

How to fix it

Apply the upstream fix in commit d530dd65f6f3c04bbf141702ecccd70170ed04ad or later; on Mageia 5 systems upgrade firefox to 38.5.0-1.mga5, firefox-l10n to 38.5.0-1.mga5, nss to 3.21.0-1.mga5, and nspr to 4.11-1.mga5; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm presence of idxd_cleanup() helper and put_device() calls for groups/engines/wqs in the remove path; exercise device registration and removal cycles while monitoring reference counts and kernel logs for leaks or crashes.

Typical attack path

1. Gain local unprivileged access on an affected Linux system
2. Trigger idxd device attach or remove operations via userspace interfaces or hardware events
3. Trigger use-after-free through unbalanced device references during cleanup
4. Corrupt kernel memory structures to escalate privileges or execute arbitrary code

How to detect it

Inspect kernel logs for idxd-related oops, warnings, or use-after-free traces during device removal; correlate with authentication events or process creation immediately following hardware cleanup operations.

What your security team should do

• Immediately schedule kernel updates on all systems exposing idxd hardware
• Limit untrusted local user access until patches are applied
• Track distribution advisories for the listed fixed package versions
• Review and restrict use of Intel DSA devices in high-risk environments