Double Free Vulnerability in Linux Kernel's I/O Acceleration Device Driver

CVE-2025-39870

What is CVE-2025-39870?

A vulnerability has been identified in the Linux kernel's I/O acceleration device driver, specifically within the idxd_setup_wqs() function. This vulnerability arises due to improper error handling, which may lead to a double free condition. When 'idxd->max_wqs' is set to zero or if the kzalloc_node() function fails, the 'conf_dev' may not be properly initialized before being released, resulting in potential memory corruption and instability. The resolution involves refining error handling mechanisms within the function to ensure proper cleanup and mitigate the risks associated with uninitialized device configurations.

References