CVE-2025-38349: eventpoll: don't decrement ep refcount while still holding the ep mutex

Versions reported by the vendor

Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.

• Linux Linux

  • 6.4affected
  • f2451def095c1743adcfcb0cb5dadc86034e162a and later · before 263f5de8302a6f2f136d392e5d3f8b1edf922857affected · git
  • a1f93804449d13f97dabd4b996817de4bf1ed67a and later · before b0821ec902d39062356cb644c16e17a705d1c9f5affected · git
  • 58c9b016e12855286370dfb704c08498edbc857a and later · before 521e9ff0b67c66a17d6f9593dfccafaa984aae4caffected · git
  • 58c9b016e12855286370dfb704c08498edbc857a and later · before 6dee745bd0aec9d399df674256e7b1ecdb615444affected · git
  • 58c9b016e12855286370dfb704c08498edbc857a and later · before 605c18698ecfa99165f36b7f59d3ed503e169814affected · git
  • 58c9b016e12855286370dfb704c08498edbc857a and later · before 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2affected · git
  • 5.15.209 and later · before 5.15.222affected · semver
  • 6.1.175 and later · before 6.1.178affected · semver
  • before 6.4not affected · semver

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV
  90Now
• CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV
  89Now
• CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV
  85Now

Published before and after this one in the same product

• ← EarlierCVE-2025-38345Jul 10, 2025 · ACPICA: fix acpi operand cache leak in dswstate.c
  22Monitor
• ← EarlierCVE-2025-38346Jul 10, 2025 · ftrace: Fix UAF when lookup kallsym after ftrace disabled
  31Monitor
• Later →CVE-2025-38350Jul 19, 2025 · net/sched: Always pass notifications when child class becomes empty
  31Monitor

Root cause

After a memory region is freed, another reference pointing to it is still used. By then, the same region may have been allocated for different data.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1free(dev->buf);2/* ... another thread is still running ... */3process(dev->buf);

1lock(&dev->lock);2free(dev->buf);3dev->buf = NULL;4unlock(&dev->lock);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.