CVE-2025-38614
published 2025-08-19CVE-2025-38614: In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
eventpoll: Fix semi-unbounded recursion
Ensure that epoll instances can never form a graph deeper than
EP_MAX_NESTS+1 links.
Currently, ep_loop_check_proc() ensures that the graph is loop-free and
does some recursion depth checks, but those recursion depth checks don't
limit the depth of the resulting tree for two reasons:
- They don't look upwards in the tree.
- If there are multiple downwards paths of different lengths, only one of
the paths is actually considered for the depth check since commit
28d82dc1c4ed ("epoll: limit paths").
Essentially, the current recursion depth check in ep_loop_check_proc() just
serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reverse_path_check() after the new graph
edge has already been created; this checks, among other things, that no
paths going upwards from any non-epoll file with a length of more than 5
edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500,
tested on v6.15. (I am unsure if deeper recursion is possible; and this may
have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion
problem").)
To fix it:
1. In ep_loop_check_proc(), note the subtree depth of each visited node,
and use subtree depths for the total depth calculation even when a subtree
has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum
depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length
between epoll nodes to EP_MAX_NESTS edges.
Affected
50 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.153-1 (bookworm) | linux 6.1.153-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 2.6.32.30 < 2.6.33 | 2.6.33 |
| linux | linux | >= 2.6.33.8 < 2.6.34 | 2.6.34 |
| linux | linux | >= 2.6.34.10 < 2.6.35 | 2.6.35 |
| linux | linux | >= 2.6.35.12 < 2.6.36 | 2.6.36 |
| linux | linux | >= 2.6.37.3 < 2.6.38 | 2.6.38 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < 71379495ab70eaba19224bd71b5b9b399eb85e04 | 71379495ab70eaba19224bd71b5b9b399eb85e04 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < 1b13b033062824495554e836a1ff5f85ccf6b039 | 1b13b033062824495554e836a1ff5f85ccf6b039 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < 2a0c0c974bea9619c6f41794775ae4b97530e0e6 | 2a0c0c974bea9619c6f41794775ae4b97530e0e6 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < 7a2125962c42d5336ca0495a9ce4cb38a63e9161 | 7a2125962c42d5336ca0495a9ce4cb38a63e9161 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6 | ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < 3542c90797bc3ab83ebab54b737d751cf3682036 | 3542c90797bc3ab83ebab54b737d751cf3682036 |
| linux | linux | >= 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e < f2e467a48287c868818085aa35389a224d226732 | f2e467a48287c868818085aa35389a224d226732 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.1.153-1 | 6.1.153-1 |
| linux | linux_kernel | >= 0 < 6.12.43-1 | 6.12.43-1 |
| linux | linux_kernel | >= 0 < 6.16.3-1 | 6.16.3-1 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM