Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2025-12706

Опубликовано: 21 авг. 2025
Источник: fstec
CVSS3: 7.3
CVSS2: 6.1
EPSS Низкий

Описание

Уязвимость функции io_futex_wait() ядра операционной системы Linux связана с использованием памяти после её освобождения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Canonical Ltd.
Red Hat Inc.
Сообщество свободного программного обеспечения

Наименование ПО

Ubuntu
Red Hat Enterprise Linux
Debian GNU/Linux
Linux

Версия ПО

22.04 LTS (Ubuntu)
9 (Red Hat Enterprise Linux)
24.04 LTS (Ubuntu)
25.04 (Ubuntu)
10 (Red Hat Enterprise Linux)
13 (Debian GNU/Linux)
от 6.12 до 6.12.44 (Linux)
от 6.16 до 6.16.4 (Linux)
до 6.17 rc3 (Linux)

Тип ПО

Операционная система

Операционные системы и аппаратные платформы

-

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 6,1)
Высокий уровень опасности (базовая оценка CVSS 3.1 составляет 7,3)

Возможные меры по устранению уязвимости

В условиях отсутствия обновлений безопасности от производителя рекомендуется придерживаться "Рекомендаций по безопасной настройке операционных систем LINUX", изложенных в методическом документе ФСТЭК России, утверждённом 25 декабря 2022 года.
Использование рекомендаций:
Для Linux:
https://lore.kernel.org/linux-cve-announce/2025090548-CVE-2025-39698-41e0@gregkh/
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2025-39698
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2025-39698
Для Ubuntu:
https://ubuntu.com/security/CVE-2025-39698

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Данные уточняются

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 4%
0.00019
Низкий

7.3 High

CVSS3

6.1 Medium

CVSS2

Связанные уязвимости

CVSS3: 8.8
ubuntu
2 месяца назад

In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.

CVSS3: 7.3
redhat
2 месяца назад

In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.

CVSS3: 8.8
nvd
2 месяца назад

In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.

CVSS3: 8.8
debian
2 месяца назад

In the Linux kernel, the following vulnerability has been resolved: i ...

CVSS3: 8.8
github
2 месяца назад

In the Linux kernel, the following vulnerability has been resolved: io_uring/futex: ensure io_futex_wait() cleans up properly on failure The io_futex_data is allocated upfront and assigned to the io_kiocb async_data field, but the request isn't marked with REQ_F_ASYNC_DATA at that point. Those two should always go together, as the flag tells io_uring whether the field is valid or not. Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well. Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.

EPSS

Процентиль: 4%
0.00019
Низкий

7.3 High

CVSS3

6.1 Medium

CVSS2