Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2025-38614— eventpoll: Fix semi-unbounded recursion

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于递归深度限制不当，可能导致资源耗尽。

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1496 · Resource Hijacking

Affected Version Matrix 26

VendorProduct Version RangeStatus
Linux Linux 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< 71379495ab70eaba19224bd71b5b9b399eb85e04 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< 1b13b033062824495554e836a1ff5f85ccf6b039 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< 2a0c0c974bea9619c6f41794775ae4b97530e0e6 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< 7a2125962c42d5336ca0495a9ce4cb38a63e9161 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< 3542c90797bc3ab83ebab54b737d751cf3682036 affected
22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e< f2e467a48287c868818085aa35389a224d226732 affected
8216e1a0d47cae06a75c42346f19dffe14e42d57 affected
… +18 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2025-38614

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
eventpoll: Fix semi-unbounded recursion
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于递归深度限制不当，可能导致资源耗尽。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e ~ 71379495ab70eaba19224bd71b5b9b399eb85e04 -
Linux Linux 2.6.38 -

II. Public POCs for CVE-2025-38614

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2025-38614

请登录查看更多情报信息。

Same Patch Batch · Linux · 2025-08-19 · 59 CVEs total

CVE-2025-38561 9.8 CRITICAL ksmbd: fix Preauh_HashValue race condition
CVE-2025-38566 9.8 CRITICAL sunrpc: fix handling of server side tls alerts
CVE-2025-38560 9.3 CRITICAL x86/sev: Evict cache lines during SNP memory validation
CVE-2025-38601 8.8 HIGH wifi: ath11k: clear initialized flag for deinit-ed srng lists
CVE-2025-38600 8.8 HIGH wifi: mt76: mt7925: fix off by one in mt7925_mcu_hw_scan()
CVE-2025-38599 8.8 HIGH wifi: mt76: mt7996: Fix possible OOB access in mt7996_tx()
CVE-2025-38592 8.8 HIGH Bluetooth: hci_devcd_dump: fix out-of-bounds via dev_coredumpv
CVE-2025-38608 8.6 HIGH bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls
CVE-2025-38574 8.6 HIGH pptp: ensure minimal skb length in pptp_xmit()
CVE-2025-38571 8.2 HIGH sunrpc: fix client side handling of tls alerts
CVE-2025-38582 7.8 HIGH RDMA/hns: Fix double destruction of rsv_qp
CVE-2025-38596 7.8 HIGH drm/panthor: Fix UAF in panthor_gem_create_with_handle() debugfs code
CVE-2025-38604 7.8 HIGH wifi: rtl818x: Kill URBs before clearing tx status queue
CVE-2025-38607 7.8 HIGH bpf: handle jset (if a & b ...) as a jump in CFG computation
CVE-2025-38615 7.8 HIGH fs/ntfs3: cancle set bad inode after removing name fails
CVE-2025-38598 7.8 HIGH drm/amdgpu: fix use-after-free in amdgpu_userq_suspend+0x51a/0x5a0
CVE-2025-38586 7.8 HIGH bpf, arm64: Fix fp initialization for exception boundary
CVE-2025-38595 7.8 HIGH xen: fix UAF in dmabuf_exp_from_pages()
CVE-2025-38580 7.8 HIGH ext4: fix inode use after free in ext4_end_io_rsv_work()
CVE-2025-38579 7.8 HIGH f2fs: fix KMSAN uninit-value in extent_info usage

Showing top 20 of 59 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2025-38614

No comments yet

Leave a comment