CVE-2025-39871

What it actually does

Duplicate put_device() call during idxd driver removal leads to reference count underflow, triggering use-after-free and potential memory corruption on module unload.

Why it matters to the business

Kernel panic or system instability can occur during driver unload or PCI device removal, disrupting workloads on systems using the idxd DMA engine and requiring unplanned reboots or patches.

How an attack unfolds

An attacker with local privileges triggers module unload or PCI driver detach, causing the duplicate device put in idxd_remove() after idxd_unregister_devices() has already released the reference, resulting in underflow and use-after-free.

How to fix it

Upgrade to Linux kernel 6.1.160 or later, or apply the fix from commit 24414bbcb37e1af95190af36c21ae51d497e1a9e in the stable tree; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel version is at least 6.1.160 and verify the idxd_remove() path no longer contains the improper idxd_free() call after the device_unregister() sequence.

Typical attack path

1. Obtain local access on a Linux system with the idxd driver loaded
2. Trigger driver removal via module unload or PCI device detachment
3. Exploit the duplicate put_device() to induce refcount underflow
4. Leverage the resulting use-after-free for memory corruption or privilege escalation

How to detect it

Review kernel logs for refcount underflow warnings and use-after-free stack traces referencing idxd_remove or idxd_free during module unload events.

What your security team should do

• Prioritize patching production kernels using the idxd driver within the next maintenance window
• Monitor for refcount underflow warnings in dmesg during module operations
• Test the updated kernel in staging environments before broad deployment