CVE-2025-39870

What it actually does

Double free vulnerability in idxd_setup_wqs() due to improper error handling around uninitialized conf_dev and failed kzalloc_node, allowing memory corruption in the Linux kernel dmaengine driver.

Why it matters to the business

Kernel memory corruption can cause system crashes, denial of service, or local privilege escalation on affected Linux systems; low exploitability but high severity on servers or containers where the idxd driver is used.

How an attack unfolds

An attacker with local access triggers specific error paths in idxd_setup_wqs() (such as invalid max_wqs or allocation failure) to cause a double free, leading to memory corruption that may be leveraged for privilege escalation; listed threat actors have targeted similar Linux kernel issues on container-optimized OS.

How to fix it

Update to fixed kernel version 6.1.153 or apply commit 25e6146c2812487a88f619d5ff6efbdcd5b2bc31; for Debian rails packages upgrade to 2:4.1.4-1.

How to confirm the fix worked

Verify kernel version is at or above 6.1.153, confirm the git commit is present, and test idxd_setup_wqs error paths no longer trigger double frees.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger idxd device initialization with crafted parameters to hit error paths in idxd_setup_wqs()
3. Exploit resulting double free for memory corruption and arbitrary code execution

How to detect it

Review kernel logs for oops or panic messages related to idxd double free; inspect for unusual memory corruption indicators in dmesg after idxd initialization attempts; correlate with container privilege escalation activity from listed threat actors.

What your security team should do

• Prioritize patching Linux kernels to 6.1.153 or later on all systems using the idxd driver
• Monitor for local privilege escalation attempts in container environments
• Restrict unprivileged access to idxd devices until patched