Linux kernel idxd: double free in idxd_setup_wqs() error path during DSA device probe

Impact

idxd_setup_wqs() mishandles its error unwind: if max_wqs is non-positive or a kzalloc_node() fails mid-loop, put_device() runs on an uninitialized or already-released conf_dev, giving a double free. idxd drives Intel DSA, the on-die data-mover that newer Xeon hosts expose to accelerate memory copies and that is sometimes handed to guests or workloads via VFIO on accelerator nodes. The flaw is on the probe/allocation error path, so it needs an allocation failure or an unusual device configuration rather than a crafted input - realistically a crash and kernel memory corruption under memory pressure, not a tenant-controlled primitive. Separate from CVE-2025-39871, which is a refcount underflow on the idxd removal path.

Who can reach it

Local, no tenant path described: the error path runs during idxd device probe on hosts with Intel DSA enabled, reached via allocation failure or an out-of-range max_wqs.

What to do

Update to a stable kernel containing the rewritten unwind (five backports linked in the record) and reboot affected hosts. Hosts that do not enable Intel DSA, or that blacklist the idxd module, are not exposed. No fixed version string is in the record.

References

Related entries

• Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driverCVE-2025-39871 · Linux kernel idxd driver (Intel DSA, device refcount on module removal)High
• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High
• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High
• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High
• Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error pathCVE-2025-39911 · Linux kernel i40e driver (Intel X710/XL710 MSI-X IRQ request error path)High
• Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds writeCVE-2025-39917 · Linux kernel BPF (bpf_crypto_crypt dynptr length check)High