Homepage

CVE-2025-39963 Affecting kernel-uek-modules-deprecated package, versions <0:6.12.0-104.43.4.3.el9uek

Severity

 Recommended
high

Based on Oracle Linux security rating.

Threat Intelligence

EPSS
0.02% (5th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ORACLE9-KERNELUEKMODULESDEPRECATED-13710237
  • published25 Oct 2025
  • disclosed9 Oct 2025
Report a new vulnerability Found a mistake?

Introduced: 9 Oct 2025

NewCVE-2025-39963  (opens in a new tab)

How to fix?

Upgrade Oracle:9 kernel-uek-modules-deprecated to version 0:6.12.0-104.43.4.3.el9uek or higher.
This issue was patched in ELSA-2025-20719.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kernel-uek-modules-deprecated package and not the kernel-uek-modules-deprecated package as distributed by Oracle. See How to fix? for Oracle:9 relevant fixed versions and status.

In the Linux kernel, the following vulnerability has been resolved:

io_uring: fix incorrect io_kiocb reference in io_link_skb

In io_link_skb function, there is a bug where prev_notif is incorrectly assigned using 'nd' instead of 'prev_nd'. This causes the context validation check to compare the current notification with itself instead of comparing it with the previous notification.

Fix by using the correct prev_nd parameter when obtaining prev_notif.