Linux Kernel CVE-2025-40047

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the kernel update from your distribution that incorporates the stable commits referenced (git.kernel.org/stable/c/2f8229d53d984c6a05b71ac9e9583d4354e3b91f and the two sibling backports 3e2205db2f06... and 696ba6032081...), which unconditionally prune the wait queue entry on success. Because exact tagged release numbers are not provided, track your vendor's advisory (e.g., the corresponding stable release for your branch) and update to the first kernel build containing the fix. As a compensating control where patching must be deferred, restrict unprivileged io_uring usage: set the sysctl kernel.io_uring_disabled=2 to disable io_uring entirely (trade-off: breaks applications that depend on io_uring performance) or =1 to limit it to processes with CAP_SYS_ADMIN (trade-off: unprivileged workloads lose io_uring). On multi-tenant hosts, also limit local/untrusted user accounts, since exploitation requires local access.