CVE-2025-39871: Linux Kernel Use-After-Free Vulnerability

CVE-2025-39871 Overview

CVE-2025-39871 is a use-after-free vulnerability [CWE-416] in the Linux kernel dmaengine: idxd driver. The flaw resides in the Intel Data Streaming Accelerator (IDXD) driver's module removal path. A duplicate put_device() call triggered by an improper idxd_free() invocation causes a reference count underflow. When CONFIG_DEBUG_KOBJECT_RELEASE is enabled, put_device() schedules asynchronous cleanup, and the subsequent idxd_free() operates on freed memory. The condition is reachable during module unload via idxd_remove() and can lead to memory corruption on affected kernels.

Critical Impact
A local, low-privileged attacker with the ability to unload the idxd driver can trigger a use-after-free, potentially leading to kernel memory corruption and local privilege escalation.

Affected Products

Linux kernel 6.15 (including rc7)
Linux kernel 6.17 release candidates (rc1 through rc5)
Systems running the Intel idxd DMA engine driver on impacted stable branches

Discovery Timeline

2025-09-23 - CVE-2025-39871 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2025-39871

Vulnerability Analysis

The vulnerability exists in the Intel Data Streaming Accelerator driver (drivers/dma/idxd) within the Linux kernel. During PCI device removal, idxd_remove() invokes idxd_unregister_devices(), which walks the registered device tree and calls device_unregister(). That path already performs the required put_device() to release the device reference.

The defective code subsequently calls idxd_free(), which issues a second put_device() on the same object. This produces a refcount_t: underflow warning at lib/refcount.c:28 and constitutes a classic use-after-free condition [CWE-416]. The kernel warning trace originates from refcount_warn_saturate and unwinds through idxd_remove, pci_device_remove, and driver_detach.

When CONFIG_DEBUG_KOBJECT_RELEASE is set, the first put_device() defers cleanup through schedule_delayed_work(). The immediate follow-up idxd_free() then dereferences memory that has been released or will imminently be released, opening a window for memory corruption.

Root Cause

The root cause is redundant reference release logic in the idxd_remove() teardown path. The developer added an explicit idxd_free() without accounting for the put_device() already performed inside device_unregister(), resulting in an off-by-one refcount decrement.

Attack Vector

Exploitation requires local access with sufficient privileges to unload the idxd kernel module through delete_module(2). On systems where the module can be reloaded or unloaded by a local user with CAP_SYS_MODULE, triggering the flawed teardown path produces the underflow. Race conditions with delayed kobject release increase the likelihood of exploitable memory reuse.

The vulnerability is not remotely exploitable and there are no known public exploits or CISA KEV entries.

Detection Methods for CVE-2025-39871

Indicators of Compromise

Kernel log entries containing refcount_t: underflow; use-after-free originating from refcount_warn_saturate+0xbe/0x110.
Warning traces referencing idxd_remove, pci_device_remove, and idxd_exit_module in dmesg output.
Unexpected idxd driver unload events (delete_module syscalls) on systems with Intel DSA hardware.

Detection Strategies

Monitor kernel ring buffer output for refcount warnings tied to the idxd module during driver unload.
Audit init_module and delete_module syscalls to identify unauthorized kernel module manipulation.
Compare running kernel versions against the fixed commits published on git.kernel.org to identify unpatched hosts.

Monitoring Recommendations

Enable auditd rules for module load and unload syscalls on hosts equipped with Intel DSA accelerators.
Forward /var/log/kern.log and journald kernel messages to a centralized log platform for correlation.
Alert on unexpected kernel WARN_ON or BUG traces referencing DMA engine subsystems.

How to Mitigate CVE-2025-39871

Immediate Actions Required

Apply the upstream Linux kernel patches that remove the improper idxd_free() call from idxd_remove().
Restrict CAP_SYS_MODULE to trusted administrators and disable dynamic module loading where operationally feasible.
Inventory hosts using the idxd driver (lsmod | grep idxd) and prioritize patching those systems.

Patch Information

The fix has been merged into stable branches through the following commits: 0e95ee7f532b, da4fbc1488a4, dd7a7e432697, and f41c538881ee. Downstream vendors have also issued advisories, including the Siemens Security Advisory SSA-019113. Rebuild and redeploy kernels from a fixed stable branch, then reboot affected hosts.

Workarounds

Blacklist the idxd module on systems that do not require Intel Data Streaming Accelerator functionality by adding blacklist idxd to /etc/modprobe.d/.
Disable CONFIG_DEBUG_KOBJECT_RELEASE in custom kernel builds to reduce the exploitability window, though this does not eliminate the refcount underflow.
Enforce kernel lockdown mode to prevent unauthorized module unloading on production systems.

bash

# Configuration example
# Prevent the idxd driver from loading on hosts that do not need it
echo 'blacklist idxd' | sudo tee /etc/modprobe.d/disable-idxd.conf
sudo depmod -a
sudo update-initramfs -u

# Verify current kernel version against fixed stable branches
uname -r

# Audit module unload events
sudo auditctl -a always,exit -F arch=b64 -S delete_module -k module_unload