CVE-2025-39966

A flaw was found in the Linux kernel such that the IOMMU file-descriptor subsystem, when aborting the allocation of a new object before installing the file descriptor, the code calls fput() on the file and then immediately frees the associated object (kfree()), but the object is still referenced by the file descriptor on a deferred workqueue. This results in a use-after-free (UAF) condition which may lead to memory corruption or system instability

Red Hat rates this vulnerability as Moderate because exploitation requires local access and relies on winning a race condition during failed IOMMU object allocations. While a successful exploit could trigger memory corruption leading to system instability or potential privilege escalation, access to the iommufd interface is typically limited to administrative users or virtualization services. Typical Red Hat Enterprise Linux environments that do not grant unprivileged access to device passthrough features remain protected against low-privileged exploitation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.