Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2025-39870

dmaengine: idxd: Fix double free in idxd_setup_wqs()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Fix double free in idxd_setup_wqs() The clean up in idxd_setup_wqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are: 1) If "idxd->max_wqs" is <= 0 then we call put_device(conf_dev) when "conf_dev" hasn't been initialized. 2) If kzalloc_node() fails then again "conf_dev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free. It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • d584acdf54f409cb7eae1359ae6c12aaabedeed8 to < 25e6146c2812487a88f619d5ff6efbdcd5b2bc31affected
  • 47846211998a9ffb0fcc08092eb95ac783d2b11a to < df82c7901513fd0fc738052a8e6a330d92cc8ec9affected
  • 5fcd392dae6d6aba7dc64ffdbb838ff191315da3 to < ec5430d090d0b6ace8fefa290fc37e88930017d2affected
  • 3fd2f4bc010cdfbc07dd21018dc65bd9370eb7a4 to < 9f0e225635475b2285b966271d5e82cba74295b1affected
  • 3fd2f4bc010cdfbc07dd21018dc65bd9370eb7a4 to < 39aaa337449e71a41d4813be0226a722827ba606affected
  • ed2c66000aa64c0d2621864831f0d04c820a1441affected
  • 6.1.140 to < 6.1.153affected
  • 6.6.92 to < 6.6.107affected
  • 6.12.30 to < 6.12.48affected
  • 6.14.8 to < 6.15affected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.1.153 to ≤ 6.1.*unaffected
  • 6.6.107 to ≤ 6.6.*unaffected
  • 6.12.48 to ≤ 6.12.*unaffected
  • 6.16.8 to ≤ 6.16.*unaffected
  • 6.17 to ≤ *unaffected

References