CVE-2025-39870
kernel: dmaengine: idxd: Fix double free in idxd_setup_wqs()
Loading…
Severity
UnknownRed Hat Product Security
CVSS
Review impact separately from score.
Published · September 23, 2025
Updated · June 30, 2026
Description
In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix double free in idxd_setup_wqs()
The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are:
- If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized.
- If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free.
It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CWE not specified