Linux Kernel CVE-2025-39963

Patch available per vendor advisory: apply the upstream kernel fix that corrects io_link_skb to use prev_nd when obtaining prev_notif, available as commits https://git.kernel.org/stable/c/2c139a47eff8de24e3350dadb4c9d5e3426db826, https://git.kernel.org/stable/c/50a98ce1ea694f1ff8e87bc2f8f84096d1736f6a, and https://git.kernel.org/stable/c/a89c34babc2e5834aa0905278f26f4dbe4b26b76; because only 6.17-rc kernels are affected, the practical remediation is to move to a later 6.17-rc build or the final 6.17 release that includes these commits (exact tagged release version not independently confirmed from the input, so treat as 'upstream fix available in-tree'). As a compensating control where patching is deferred, restrict unprivileged access to io_uring - for example set the sysctl kernel.io_uring_disabled=2 to disable io_uring for all unprivileged users, or =1 to gate it behind a permitted group - which removes the attack surface entirely; the trade-off is that any legitimate workloads relying on io_uring (some high-performance servers, databases, and container runtimes) will lose that acceleration or fail. Avoid running 6.17 release-candidate kernels on multi-tenant or security-sensitive hosts until the fix is confirmed present.