Incorrect io_kiocb Reference in Linux Kernel Affects Multiple Releases

CVE-2025-39963

What is CVE-2025-39963?

A vulnerability in the Linux kernel's io_uring subsystem arises from an incorrect reference assignment in the io_link_skb function. Specifically, the parameter 'prev_notif' inadvertently uses 'nd' instead of the proper 'prev_nd' for context validation checks. This flaw compromises the ability to correctly compare the current notification against the previous one, potentially leading to unexpected behavior in notification handling. The issue has been addressed by ensuring the correct parameter is utilized, reinforcing the security measures in place for notification processing.

References