In the Linux kernel, the following vulnerability has been resolved:
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for
reporting this.
References
Configurations
No configuration.
History
17 Oct 2025, 13:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-672 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
10 Oct 2025, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
05 Sep 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-09-05 18:15
Updated : 2025-10-17 13:15
NVD link : CVE-2025-39698
Mitre link : CVE-2025-39698
CVE.ORG link : CVE-2025-39698
JSON object : View
Products Affected
No product.
CWE
CWE-672
Operation on a Resource after Expiration or Release