CVE-2025-39963
published 2025-10-09CVE-2025-39963: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is…
PriorityP339high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.14%
3.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.
Fix by using the correct prev_nd parameter when obtaining prev_notif.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.16.9-1 (forky) | linux 6.16.9-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= 6fe4220912d19152a26ce19713ab232f4263018d < a89c34babc2e5834aa0905278f26f4dbe4b26b76 | a89c34babc2e5834aa0905278f26f4dbe4b26b76 |
| linux | linux | >= 6fe4220912d19152a26ce19713ab232f4263018d < 50a98ce1ea694f1ff8e87bc2f8f84096d1736f6a | 50a98ce1ea694f1ff8e87bc2f8f84096d1736f6a |
| linux | linux | >= 6fe4220912d19152a26ce19713ab232f4263018d < 2c139a47eff8de24e3350dadb4c9d5e3426db826 | 2c139a47eff8de24e3350dadb4c9d5e3426db826 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.12.57-1 | 6.12.57-1 |
| linux | linux_kernel | >= 0 < 6.16.9-1 | 6.16.9-1 |
| linux | linux_kernel | >= 6.10 < 6.12.49 | 6.12.49 |
| linux | linux_kernel | >= 6.13 < 6.16.9 | 6.16.9 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8LOW
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-39963: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function,
osv·2025-10-09·CVSS 7.8
CVE-2025-39963 [HIGH] CVE-2025-39963: In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function,
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
GHSA
GHSA-w6f6-h6gc-qpjj: In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb functio
ghsa_unreviewed·2025-10-09
CVE-2025-39963 [HIGH] CWE-401 GHSA-w6f6-h6gc-qpjj: In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb functio
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.
Fix by using the correct prev_nd parameter when obtaining prev_notif.
Red Hat
kernel: io_uring: fix incorrect io_kiocb reference in io_link_skb
vendor_redhat·2025-10-09·CVSS 7.8
CVE-2025-39963 [HIGH] CWE-1025 kernel: io_uring: fix incorrect io_kiocb reference in io_link_skb
kernel: io_uring: fix incorrect io_kiocb reference in io_link_skb
In the Linux kernel, the following vulnerability has been resolved:
io_uring: fix incorrect io_kiocb reference in io_link_skb
In io_link_skb function, there is a bug where prev_notif is incorrectly
assigned using 'nd' instead of 'prev_nd'. This causes the context
validation check to compare the current notification with itself instead
of comparing it with the previous notification.
Fix by using the correct prev_nd parameter when obtaining prev_notif.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Ente
Debian
CVE-2025-39963: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: f...
vendor_debian·2025·CVSS 7.8
CVE-2025-39963 [HIGH] CVE-2025-39963: linux - In the Linux kernel, the following vulnerability has been resolved: io_uring: f...
In the Linux kernel, the following vulnerability has been resolved: io_uring: fix incorrect io_kiocb reference in io_link_skb In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification. Fix by using the correct prev_nd parameter when obtaining prev_notif.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.16.9-1)
sid: resolved (fixed in 6.16.9-1)
trixie: resolved (fixed in 6.12.57-1)
No detection rules found.
No public exploits indexed.
2025-10-09
Published