CVE-2025-38687Race Condition in Linux

CWE-362Race Condition30 documents8 sources
Severity
4.7MEDIUMNVD
EPSS
0.0%
top 94.07%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedSep 4
Latest updateMar 25

Description

In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks qu

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages3 packages

NVDlinux/linux_kernel3.145.4.297+7
Debianlinux/linux_kernel< 5.10.244-1+3
CVEListV5linux/linux2f3fdcd7ce935f6f2899ceab57dc8fe5286db3e1fe67122ba781df44a1a9716eb1dfd751321ab512+9

Also affects: Debian Linux 11.0

Patches

🔴Vulnerability Details

3
GHSA
GHSA-gmr8-hqwc-6phj: In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free i2025-09-05
OSV
CVE-2025-38687: In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in2025-09-04
CVEList
comedi: fix race between polling and detaching2025-09-04

📋Vendor Advisories

26
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-25
Ubuntu
Linux kernel (Azure) vulnerabilities2026-03-04
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities2026-03-04
Ubuntu
Linux kernel (Xilinx) vulnerabilities2026-02-24
Ubuntu
Linux kernel (IBM) vulnerabilities2026-02-24
CVE-2025-38687 — Race Condition in Linux | cvebase