CVE-2025-39698: Linux Kernel io_uring Futex Request Use-After-Free Local Privilege Escalation Vulnerability
In the Linux kernel, the following vulnerability has been resolved:
iouring/futex: ensure iofutexwait() cleans up properly on failure
The iofutexdata is allocated upfront and assigned to the iokiocb asyncdata field, but the request isn't marked with REQFASYNCDATA at that point. Those two should always go together, as the flag tells iouring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but does not clear ->asyncdata. Clear the data and the flag in the error path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the the iouring subsystem. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2025-39698?
The severity of CVE-2025-39698 has been evaluated and is classified as medium due to potential denial of service risks.
How do I fix CVE-2025-39698?
To fix CVE-2025-39698, you should update to the latest patched version of the Linux kernel provided by your vendor.
What systems are affected by CVE-2025-39698?
CVE-2025-39698 affects various versions of the Linux kernel, particularly those utilizing the io_uring and futex subsystems.
What is the potential impact of CVE-2025-39698?
The potential impact of CVE-2025-39698 includes disruptions to system stability and possible denial of service.
Has CVE-2025-39698 been resolved?
Yes, CVE-2025-39698 has been resolved in subsequent updates to the Linux kernel.