Use-After-Free Vulnerability in Linux Kernel Affecting Device Management

CVE-2025-39871

What is CVE-2025-39871?

A use-after-free vulnerability was detected in the Linux kernel’s dmaengine subsystem, specifically when handling device management in the idxd driver. The improper call to idxd_free() on device removal led to a reference count underflow, exposing the system to potential memory corruption. This can occur during module unload, particularly when CONFIG_DEBUG_KOBJECT_RELEASE is enabled, as it can trigger delayed work that interferes with memory management. Removing the unnecessary idxd_free() resolves these issues, preventing both memory leaks and crashes.

References