Vulnerability in the io_uring subsystem allows privilege escalation in the system
A vulnerability (CVE-2025-39698) has been identified in the asynchronous I/O interface io_uring provided by the Linux kernel, allowing an unprivileged user to execute their code at the kernel level. The vulnerability is caused by the lack of existence checks for an object before operations are performed on that object. The vulnerability has been addressed in kernel updates 6.16.4 and 6.12.44. The status of the new version of the package or a fix in distributions can be checked on the following pages […]
