{"id":"CVE-2025-38614","revision":null,"records":[{"revision":"64bef020652d451ebd85d208f111821c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38614","aliases":[],"title":"eventpoll: Fix semi-unbounded recursion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n the paths is actually considered for the depth check since commit\n 28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.","state":0,"publishedAt":"2025-08-19T17:03:56.348+00:00","modifiedAt":"2026-10-15T22:02:26.774+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/eventpoll.c\"\n ],\n \"versions\": [\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"71379495ab70eaba19224bd71b5b9b399eb85e04\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"1b13b033062824495554e836a1ff5f85ccf6b039\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"2a0c0c974bea9619c6f41794775ae4b97530e0e6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"7a2125962c42d5336ca0495a9ce4cb38a63e9161\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"3542c90797bc3ab83ebab54b737d751cf3682036\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"f2e467a48287c868818085aa35389a224d226732\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8216e1a0d47cae06a75c42346f19dffe14e42d57\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"28a92748aa4bc57d35e7b079498b0ac2e7610a37\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"7eebcd4792c5a341559aed327b6afecbb1c46402\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0eccd188cfeaf857a26f2d72941d27d298cf6a54\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"a72affdbb09f3f24f64ffcbbdf62c2e57c58f379\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"2.6.32.30\",\n \"lessThan\": \"2.6.33\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.33.8\",\n \"lessThan\": \"2.6.34\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.34.10\",\n \"lessThan\": \"2.6.35\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.35.12\",\n \"lessThan\": \"2.6.36\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.37.3\",\n \"lessThan\": \"2.6.38\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/eventpoll.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.38\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.38\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.190\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.149\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.103\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.43\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.15.11\",\n \"lessThanOrEqual\": \"6.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16.1\",\n \"lessThanOrEqual\": \"6.16.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04","https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039","https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6","https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161","https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6","https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036","https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38614","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38614","identifiers":["CVE-2025-38614"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1773794+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1773831+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-bc5670b92e6417137e6d98178f734a585c0efdac3c24cdab996a156ba398735b","complete":true,"records":421397,"lastAttemptAt":"2026-11-09T12:02:16.4943065+00:00","lastSuccessAt":"2026-11-09T12:02:16.4102763+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.4943065+00:00","snapshotPublishedAt":"2026-11-09T11:21:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-469e0902b40147e98a6498cf72d41be8","complete":true,"records":13655,"lastAttemptAt":"2026-11-09T12:14:17.3321495+00:00","lastSuccessAt":"2026-11-09T12:14:17.327+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:14:17.327+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T12:02:21.9910047+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T12:02:21.9910047+00:00","lastSuccessAt":"2026-11-09T12:02:22.1781502+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:22.1781508+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-44231a3c29e84c64b271bb4e9b8f3678","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T12:02:23.2886601+00:00","lastSuccessAt":"2026-11-09T12:02:23.284+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:23.284+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T12:02:17.2599038+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.2599038+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T12:02:16.7165115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:16.7165115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T12:02:21.9559708+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:21.9559708+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e6e6ac3eaece246ff08884368fe1dc99d4d393571e77c126c8f4d38d66697688","complete":true,"records":231297,"lastAttemptAt":"2026-11-09T12:02:17.0901763+00:00","lastSuccessAt":"2026-11-09T10:04:27.0059369+00:00","error":null,"lastVerifiedAt":"2026-11-09T12:02:17.0901763+00:00","snapshotPublishedAt":"2026-11-09T09:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}