CVE-2025-39963

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix incorrect io_kiocb reference in io_link_skb

In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification.

Fix by using the correct prev_nd parameter when obtaining prev_notif.

A low-impact flaw was found in the Linux kernel's io_uring subsystem, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and the kernel package in Red Hat Enterprise Linux 10. In the io_link_skb() function, the pointer to the previous notification is incorrectly derived from the current notification descriptor ('nd' instead of 'prev_nd'), so the context validation compares the current notification with itself rather than with the previous notification. This can render ineffective the check that stacked notifications belong to the same io_uring context and can be completed in the same task_work, leading to potential mis-association of notification objects. A local user able to use io_uring can reach this code path without special privileges; however, the upstream fix describes a correctness bug with no demonstrated use-after-free or out-of-bounds access, so the realistic security impact is limited. Red Hat Enterprise Linux 6, 7, and 8, and Red Hat In-Vehicle OS 1, are not affected because the vulnerable code is not present in those products. For the affected Red Hat Enterprise Linux 9 and 10 streams, the fix is deferred because of the low security impact; the residual risk is limited to weakened validation of io_uring notification context ownership, which could only matter in combination with other io_uring lifetime bugs. The difference from the NIST/CVE.org CVSS score of 7.8 (Important) reflects that Red Hat found no evidence of confidentiality or integrity impact and scored the flaw accordingly (CVSS 5.5, availability impact only).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.