DEBIAN-CVE-2025-39870
In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix double free in idxd_setup_wqs() The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located.
Risk Scores
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Debian:11 | linux-6.1 | 0, *, 6.1.148-1 |
| Debian:13 | linux | 6.12.41-1, 0, 6.12.43-1 |
| Debian:12 | linux | 0, 0, 6.1.106-1 |
| Debian:14 | linux | 6.13~rc7-1~exp1, 6.13~rc6-1~exp1, 6.13.9-1~exp1 |
Exploit Intelligence
- 4081.3.7.yml (github-poc)
Timeline
- Sep 23, 2025 CVE Published
- Apr 28, 2026 CVE Updated