Linux Kernel Vulnerability in io_uring and futex Handling

CVE-2025-39698

What is CVE-2025-39698?

A vulnerability exists in the Linux kernel's io_uring and futex handling, where the io_futex_data is assigned to the async_data field without the necessary flag, REQ_F_ASYNC_DATA. This discrepancy can lead to improper data management and error handling. During fault conditions, the futex handler fails to clear the async_data flag after freeing the data, which may result in inconsistencies or potential data misuse. Prompt updates and patches address this issue, ensuring synchronized cleaning of both the async_data field and its associated flag.

References