CVE-2025-40047

A flaw use after free in the Linux kernel IO_URING subsystem was found in the way local user uses io_uring interface (using IORING_OP_WAITID). A local user could use this flaw to crash the system or potentially escalate their privileges on the system.

io_waitid_wait() didn’t always prune the wait-queue entry on success when a cancellation was in progress, leaving the entry on the list and racing with another callback, which could lead to double callbacks and list corruption (potential UAF). The IO_URING enabled only in latest versions of Red Hat Enterprise Linux (from 9.3).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.