CVE-2025-39870

Q: What is the severity of CVE-2025-39870?

CVE-2025-39870 has a CVSS score of 7.8 (HIGH). This CVE describes a double-free vulnerability in the Linux kernel's dmaengine idxd driver. The bug occurs during error handling in the idxd_setup_wqs() function, which can lead to memory corruption and potential kernel crashes or privilege escalation. Systems using Intel Data Streaming Accelerator (DSA) devices with vulnerable kernel versions are affected.

7.8 HIGH

Denial of Service

📋 TL;DR

This CVE describes a double-free vulnerability in the Linux kernel's dmaengine idxd driver. The bug occurs during error handling in the idxd_setup_wqs() function, which can lead to memory corruption and potential kernel crashes or privilege escalation. Systems using Intel Data Streaming Accelerator (DSA) devices with vulnerable kernel versions are affected.

💻 Affected Systems

Products:

Linux kernel with Intel Data Streaming Accelerator (DSA) driver enabled

Versions: Kernel versions containing the vulnerable idxd driver code prior to the fix commits

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only vulnerable when CONFIG_INTEL_IDXD is enabled and Intel DSA hardware is present/used. Most systems don't have this hardware by default.

📦 What is this software?

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Kernel panic leading to system crash, or potential privilege escalation to kernel mode allowing full system compromise.

🟠

Likely Case

Kernel crash causing system instability or denial of service, requiring reboot to restore functionality.

🟢

If Mitigated

System remains stable if error conditions aren't triggered; minimal impact with proper access controls limiting who can interact with DSA devices.

🌐 Internet-Facing: LOW - This vulnerability requires local access to the system and interaction with specific kernel interfaces.

🏢 Internal Only: MEDIUM - Local users or processes with appropriate permissions could trigger the vulnerability, potentially causing system instability.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires triggering specific error conditions in the idxd_setup_wqs() function, which may require local access and specific hardware/driver interactions.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Fixed in kernel commits: 25e6146c2812487a88f619d5ff6efbdcd5b2bc31, 39aaa337449e71a41d4813be0226a722827ba606, 9f0e225635475b2285b966271d5e82cba74295b1, df82c7901513fd0fc738052a8e6a330d92cc8ec9, ec5430d090d0b6ace8fefa290fc37e88930017d2

Vendor Advisory: https://git.kernel.org/stable/c/25e6146c2812487a88f619d5ff6efbdcd5b2bc31

Restart Required: Yes

Instructions:

1. Update to a kernel version containing the fix commits. 2. Check your distribution's security advisories for patched kernel packages. 3. Reboot the system after kernel update.

🔧 Temporary Workarounds

Disable Intel DSA driver

linux

Prevent loading of the vulnerable idxd driver module

echo 'blacklist idxd' > /etc/modprobe.d/disable-idxd.conf
rmmod idxd

Disable CONFIG_INTEL_IDXD at kernel build

linux

Build kernel without Intel DSA driver support

In kernel config: CONFIG_INTEL_IDXD=n

🧯 If You Can't Patch

Restrict access to users who can interact with DSA devices through appropriate permissions and SELinux/AppArmor policies.
Monitor system logs for kernel panics or unexpected reboots that may indicate exploitation attempts.

🔍 How to Verify

Check if Vulnerable:

Check if idxd driver is loaded: lsmod | grep idxd. Check kernel version against patched versions.

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes fix commits. Check dmesg for idxd driver initialization errors.

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/messages or journalctl
OOM killer activity related to kernel memory
Unexpected system reboots

Network Indicators:

None - this is a local vulnerability

SIEM Query:

source="kernel" AND ("panic" OR "Oops" OR "BUG") AND ("idxd" OR "dmaengine")

📊 Metadata

CVE ID: CVE-2025-39870

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-415

EPSS Score: 0.02% exploit probability (5.6th percentile)

Published: September 23, 2025

Last Updated: January 20, 2026

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Debian Linux by Debian

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable Intel DSA driver

Disable CONFIG_INTEL_IDXD at kernel build

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities