{"id":"CVE-2025-38614","revision":"64bef020652d451ebd85d208f111821c","records":[{"revision":"64bef020652d451ebd85d208f111821c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-38614","aliases":[],"title":"eventpoll: Fix semi-unbounded recursion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n the paths is actually considered for the depth check since commit\n 28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.","state":0,"publishedAt":"2025-08-19T17:03:56.348+00:00","modifiedAt":"2026-10-15T22:02:26.774+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/eventpoll.c\"\n ],\n \"versions\": [\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"71379495ab70eaba19224bd71b5b9b399eb85e04\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"1b13b033062824495554e836a1ff5f85ccf6b039\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"2a0c0c974bea9619c6f41794775ae4b97530e0e6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"7a2125962c42d5336ca0495a9ce4cb38a63e9161\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"3542c90797bc3ab83ebab54b737d751cf3682036\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e\",\n \"lessThan\": \"f2e467a48287c868818085aa35389a224d226732\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"8216e1a0d47cae06a75c42346f19dffe14e42d57\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"28a92748aa4bc57d35e7b079498b0ac2e7610a37\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"7eebcd4792c5a341559aed327b6afecbb1c46402\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"0eccd188cfeaf857a26f2d72941d27d298cf6a54\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"a72affdbb09f3f24f64ffcbbdf62c2e57c58f379\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"2.6.32.30\",\n \"lessThan\": \"2.6.33\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.33.8\",\n \"lessThan\": \"2.6.34\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.34.10\",\n \"lessThan\": \"2.6.35\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.35.12\",\n \"lessThan\": \"2.6.36\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"2.6.37.3\",\n \"lessThan\": \"2.6.38\",\n \"status\": \"affected\",\n \"versionType\": \"semver\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/eventpoll.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.38\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.38\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.190\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.149\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.103\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.43\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.15.11\",\n \"lessThanOrEqual\": \"6.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.16.1\",\n \"lessThanOrEqual\": \"6.16.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.17\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04","https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039","https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6","https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161","https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6","https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036","https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-38614","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-38614","identifiers":["CVE-2025-38614"]},"retained":false,"historicalAffected":[]}],"coverage":[]}