Linux kernel idxd: refcount underflow and use-after-free when unloading the Intel DSA driver

Impact

idxd_remove() called idxd_free() after idxd_unregister_devices() had already dropped the device reference through device_unregister(), producing a refcount underflow ("use-after-free" warning in the record's trace) and, with CONFIG_DEBUG_KOBJECT_RELEASE where put_device() defers cleanup, a real use-after-free during module unload. On accelerator hosts that enable Intel DSA, this is hit by removing the idxd module or hot-unplugging the device - a thing operators do during maintenance, not something a tenant drives. Impact is kernel memory corruption or a panic on an otherwise routine driver unload. Distinct from CVE-2025-39870, which is a double free on the work-queue setup path.

Who can reach it

Local and privileged: requires the ability to unload the idxd module or remove the PCI device, i.e. root on the host. No tenant or network path.

What to do

Move to a stable kernel with the offending idxd_free() removed (five backports linked) and reboot the node. Until then, avoid unloading or rebinding idxd on production hosts. The record does not name a fixed release - match the commits to your branch.

References

Related entries

• Linux kernel DAMON sysfs: use-after-free reading kdamond state while a context is torn downCVE-2025-39877 · Linux kernel DAMON sysfs interface (state_show, /sys/kernel/mm/damon)High
• Linux kernel libceph: messenger reads and writes the v1 union member while msgr2 is in use, corrupting connection stateCVE-2025-39880 · Linux kernel libceph messenger (con->v1 union accessed while msgr2 is active)High
• Linux kernel FUSE: slab out-of-bounds write in fuse_dev_do_write when the retrieve length is truncatedCVE-2025-39888 · Linux kernel FUSE (fuse_dev_do_write, folio limit check)High
• Linux kernel i40e: wrong dev_id in free_irq() leaves IRQs un-freed on the MSI-X error pathCVE-2025-39911 · Linux kernel i40e driver (Intel X710/XL710 MSI-X IRQ request error path)High
• Linux kernel BPF: missing destination length check in bpf_crypto_crypt allows out-of-bounds writeCVE-2025-39917 · Linux kernel BPF (bpf_crypto_crypt dynptr length check)High
• Linux kernel io_uring: io_link_skb compares a notification against itself, skipping the context validation checkCVE-2025-39963 · Linux kernel io_uring zero-copy send (io_link_skb notification context check)High