Executive brief
A vulnerability was identified in the Linux kernel's io_uring subsystem, which handles high-performance input/output operations. A logic error in how the system tracks data notifications could allow a local attacker to bypass security checks, potentially leading to unauthorized data access or system instability. This issue affects systems running specific versions of the Linux kernel and has been addressed in recent updates.
Technical details
A vulnerability exists in the io_link_skb function within io_uring/notif.c due to an incorrect variable assignment. Specifically, the variable 'prev_notif' was incorrectly assigned using 'nd' instead of 'prev_nd', causing the kernel to perform context validation by comparing a notification against itself rather than the intended previous notification. This flaw can lead to a failure in task_work isolation and potentially trigger memory leaks (CWE-401) or other memory corruption scenarios. An attacker with local access can exploit this to escalate privileges or cause a denial of service. Patches have been released for stable kernel branches including 6.12.49 and 6.16.9.
Affected products
- Linux Linux Kernel 6.10 to 6.12.49, 6.13 to 6.16.9
Timeline
- 2025-09-19: patched: Initial fix committed to Linux kernel tree
- 2025-10-09: disclosed: CVE-2025-39963 published