CVE-2025-39698

In the Linux kernel, the following vulnerability has been resolved:

iouring/futex: ensure iofutex_wait() cleans up properly on failure

The iofutexdata is allocated upfront and assigned to the iokiocb asyncdata field, but the request isn't marked with REQFASYNCDATA at that point. Those two should always go together, as the flag tells iouring whether the field is valid or not.

Additionally, on failure cleanup, the futex handler frees the data but does not clear ->async_data. Clear the data and the flag in the error path as well.

Thanks to Trend Micro Zero Day Initiative and particularly ReDress for reporting this.