CVE-2025-39966 Overview
CVE-2025-39966 is a use-after-free vulnerability in the Linux kernel's iommufd subsystem, triggered by a race condition during file descriptor abort handling. The flaw resides in the object allocation path where fput() defers the actual release() callback to a work queue. When allocation of a new iommufd_object aborts before installing the file, the code calls fput() and immediately frees the object with kfree(). The deferred release later dereferences the freed object, producing a UAF detected by KASAN in iommufd_eventq_fops_release(). The issue affects Linux kernel 6.17 release candidates and has been resolved upstream.
Critical Impact
A local, low-privileged attacker with access to the iommufd interface can trigger memory corruption in the kernel, potentially leading to privilege escalation or denial of service.
Affected Products
- Linux kernel 6.17-rc1 through 6.17-rc7
- Linux distributions shipping mainline iommufd from the 6.17 development series
- Systems exposing /dev/iommu to unprivileged or containerized workloads
Discovery Timeline
- 2025-10-15 - CVE-2025-39966 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2025-39966
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] between the file descriptor teardown work queue and the object destruction path in drivers/iommu/iommufd/. The kernel's fput() function does not synchronously invoke file_operations->release(). Instead, it schedules the release on a work queue. In iommufd, a struct file and its corresponding iommufd_object are tightly coupled: the file stores the object as private_data and holds a users refcount, while the object must remain alive for the entire lifetime of the file.
When iommufd allocates a new object and encounters an error before installing the file into the process file descriptor table, cleanup logic calls fput() on the file and then immediately calls kfree() on the object. The deferred release callback subsequently runs iommufd_eventq_fops_release() and executes refcount_dec() on the already freed memory, producing the use-after-free reported by KASAN.
Root Cause
The root cause is asymmetric lifetime management. The abort path assumes fput() behaves synchronously, but fput() queues the release for later execution via task_work_run(). This creates a window where object memory is reclaimed while a reference to it still exists in the pending release callback.
Attack Vector
Exploitation requires local access and the ability to invoke iommufd ioctls that allocate objects backed by file descriptors, such as event queue creation. An attacker triggers the abort path by inducing allocation failures during object setup, then races the deferred fput() worker against subsequent kernel allocations to reclaim the freed slab memory with attacker-controlled data. The fix moves file lifetime management into the core iommufd code and uses __fput_sync() during abort so that release() completes before kfree() runs. See the upstream patches for the corrected control flow: Kernel Git Commit 17195a7, Kernel Git Commit 4e034bf, and Kernel Git Commit e482536.
Detection Methods for CVE-2025-39966
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in iommufd_eventq_fops_release in kernel logs
- Unexpected kernel oops or panic entries in dmesg mentioning __fput, task_work_run, and iommufd
- Unprivileged processes making high-frequency ioctl() calls against /dev/iommu
Detection Strategies
- Monitor kernel ring buffer output for KASAN and refcount warnings originating from drivers/iommu/iommufd/eventq.c
- Audit access to the /dev/iommu character device and correlate with process lineage for anomalous callers
- Track kernel version fingerprints across the fleet to identify hosts running vulnerable 6.17-rc builds
Monitoring Recommendations
- Enable CONFIG_KASAN and panic_on_warn on non-production kernels to surface UAF conditions during testing
- Forward auditd records for ioctl syscalls on /dev/iommu to a centralized log store for retrospective analysis
- Alert on repeated failed iommufd object allocations, which may indicate fault-injection style exploitation attempts
How to Mitigate CVE-2025-39966
Immediate Actions Required
- Upgrade Linux kernel to a stable release that incorporates commits 17195a7, 4e034bf, and e4825368
- Restrict access to /dev/iommu so only trusted system components can open the device
- Avoid running Linux kernel 6.17-rc builds on production or multi-tenant hosts
Patch Information
The fix relocates file lifetime handling into the iommufd core and calls __fput_sync() during the abort path, ensuring the file's release() executes before the object is freed. Merged patches are available at Kernel Git Commit 17195a7, Kernel Git Commit 4e034bf, and Kernel Git Commit e482536.
Workarounds
- Disable the iommufd subsystem in the kernel configuration if IOMMU userspace management is not required
- Apply mandatory access control policies (SELinux, AppArmor) that deny non-root processes access to /dev/iommu
- Remove or restrict permissions on /dev/iommu where feasible using udev rules to limit exposure to unprivileged users
# Configuration example: restrict /dev/iommu via udev
# /etc/udev/rules.d/99-iommu-restrict.rules
KERNEL=="iommu", MODE="0600", OWNER="root", GROUP="root"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
