In the Linux kernel, the following vulnerability has been resolved:
dmaengine: idxd: Fix double free in idxdsetupwqs()
The clean up in idxdsetupwqs() has had a couple bugs because the error handling is a bit subtle. It's simpler to just re-write it in a cleaner way. The issues here are:
1) If "idxd->maxwqs" is <= 0 then we call putdevice(confdev) when "confdev" hasn't been initialized. 2) If kzallocnode() fails then again "confdev" is invalid. It's either uninitialized or it points to the "conf_dev" from the previous iteration so it leads to a double free.
It's better to free partial loop iterations within the loop and then the unwinding at the end can handle whole loop iterations. I also renamed the labels to describe what the goto does and not where the goto was located.
[
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2132.0,
"function_hash": "168651134314487434774307682438822763869"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec5430d090d0b6ace8fefa290fc37e88930017d2",
"target": {
"file": "drivers/dma/idxd/init.c",
"function": "idxd_setup_wqs"
},
"id": "CVE-2025-39870-06c17c15"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"211262030481274471838524520695122609429",
"313390594556073769006602829226013099369",
"289683541762605517745284968052041703498",
"143721667581446491263425556797362700498",
"137506603101912485541167922151314725318",
"1962260332343715322555574144971700423",
"136167886935381985009416744763327470778",
"58006402522490069725794237513873100414",
"50517026081563355115511775945255579698",
"30581706439953526398508125413179133411",
"339068064056962303782865489417177738670",
"77278572534476539421996860329173299637",
"237964282818486348431822104528450650822",
"14973967681254661132692200157889009698",
"2334365575538734389307733436601053468",
"21079605560598653205909563305069753458",
"221147502637962125809474545241716216810",
"310934551112910122532935855948628428328",
"144652680587621351101532961922434643836",
"97195510999503473757313408822540096310",
"233821821795365082768152907254492060821",
"103453012050719703675002218547400926842",
"96126159324455928586152374520318166796",
"128756829216441414222683573614634108420",
"213462833426960816010293848523360492166",
"127896398608564722667200130049167968536",
"146587777134323669026297425757352937152",
"334038312197647313458063065988055501591",
"83496363196858133058540100249552091419",
"248703406029082081861029939370736092305",
"285531377360088900431615415801348651871",
"56439515737141597543977408992264236228",
"156079339110728811963007781527268620147",
"193062718769982767990543460674921010578",
"70876942407295327972413208758474826031",
"39496325904552843915045188314369123440",
"279661740106169205798286069416346459880",
"337631820940396136359928810279713680299",
"137436548516585027822563623322214397476",
"260136451909756423710550887045056587062",
"215036095626742433000845739649401692869",
"336245070729970649642370034999010457222",
"42216099761392745305794863730526118543",
"299717636484520268194984389899609943205",
"102017098212447691456588996643238197939",
"245166547470096736213427872055084144259",
"218807675719938378745753334534246498169",
"47561699544122491909058415388956633059"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ec5430d090d0b6ace8fefa290fc37e88930017d2",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"id": "CVE-2025-39870-74deed78"
},
{
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"digest": {
"length": 2132.0,
"function_hash": "168651134314487434774307682438822763869"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25e6146c2812487a88f619d5ff6efbdcd5b2bc31",
"target": {
"file": "drivers/dma/idxd/init.c",
"function": "idxd_setup_wqs"
},
"id": "CVE-2025-39870-7c35254b"
},
{
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"digest": {
"line_hashes": [
"211262030481274471838524520695122609429",
"313390594556073769006602829226013099369",
"289683541762605517745284968052041703498",
"143721667581446491263425556797362700498",
"137506603101912485541167922151314725318",
"1962260332343715322555574144971700423",
"136167886935381985009416744763327470778",
"58006402522490069725794237513873100414",
"50517026081563355115511775945255579698",
"30581706439953526398508125413179133411",
"339068064056962303782865489417177738670",
"77278572534476539421996860329173299637",
"237964282818486348431822104528450650822",
"14973967681254661132692200157889009698",
"2334365575538734389307733436601053468",
"21079605560598653205909563305069753458",
"221147502637962125809474545241716216810",
"310934551112910122532935855948628428328",
"144652680587621351101532961922434643836",
"97195510999503473757313408822540096310",
"233821821795365082768152907254492060821",
"103453012050719703675002218547400926842",
"96126159324455928586152374520318166796",
"128756829216441414222683573614634108420",
"213462833426960816010293848523360492166",
"127896398608564722667200130049167968536",
"146587777134323669026297425757352937152",
"334038312197647313458063065988055501591",
"83496363196858133058540100249552091419",
"248703406029082081861029939370736092305",
"285531377360088900431615415801348651871",
"56439515737141597543977408992264236228",
"156079339110728811963007781527268620147",
"193062718769982767990543460674921010578",
"70876942407295327972413208758474826031",
"39496325904552843915045188314369123440",
"279661740106169205798286069416346459880",
"337631820940396136359928810279713680299",
"137436548516585027822563623322214397476",
"260136451909756423710550887045056587062",
"215036095626742433000845739649401692869",
"336245070729970649642370034999010457222",
"42216099761392745305794863730526118543",
"299717636484520268194984389899609943205",
"102017098212447691456588996643238197939",
"245166547470096736213427872055084144259",
"218807675719938378745753334534246498169",
"47561699544122491909058415388956633059"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@25e6146c2812487a88f619d5ff6efbdcd5b2bc31",
"target": {
"file": "drivers/dma/idxd/init.c"
},
"id": "CVE-2025-39870-fb58eb0f"
}
]