[SRU][N][PATCH 0/1] CVE-2025-39698

[Massimiliano Pellizzer]

https://ubuntu.com/security/CVE-2025-39698

[ Impact ]

io_uring/futex: ensure io_futex_wait() cleans up properly on failure

The io_futex_data is allocated upfront and assigned to the io_kiocb
async_data field, but the request isn't marked with REQ_F_ASYNC_DATA
at that point. Those two should always go together, as the flag tells
io_uring whether the field is valid or not.

Additionally, on failure cleanup, the futex handler frees the data but
does not clear ->async_data. Clear the data and the flag in the error
path as well.

[ Fix ]

Backport the fix commit from upstream:
* 508c1314b342b io_uring/futex: ensure io_futex_wait() cleans up properly on failure

[ Test Plan ]

Compile tested.

[ Regression Potential ]

A regression here is unlikely due to the very limited scope
of the patch.

[ Other Info ]

Plucky not fixed because it's EOL.

Jens Axboe (1):
  io_uring/futex: ensure io_futex_wait() cleans up properly on failure

 io_uring/futex.c | 3 +++
 1 file changed, 3 insertions(+)

-- 
2.51.0