CVE-2025-39698 io_uring/futex: ensure io_futex_wait() cleans up properly on failure
A use-after-free vulnerability in the Linux kernel's io_uring futex implementation allows attackers to potentially execute arbitrary code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-39698?
CVE-2025-39698 is a high-severity use after free vulnerability in Linux kernel, published on 5 Sep 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/futex: ensure io_futex_wait() cleans up properly on failure
The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not.
Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well.
Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.
Which versions are affected by CVE-2025-39698?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-39698?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-39698 being exploited?
There is no known exploitation of CVE-2025-39698 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2025-39698, DEBIAN-CVE-2025-39698, GHSA-q7v5-hrgw-5gjh, ROOT-OS-DEBIAN-13-CVE-2025-39698, ROOT-OS-UBUNTU-2404-CVE-2025-39698.