CVE-2025-38614: eventpoll: Fix semi-unbounded recursion
Noroxi assessment
Priority: Monitor (action score 22/100)
- The sources we track (CISA KEV, Exploit-DB, Metasploit, Nuclei, GitHub) show no public exploit code or exploitation in the wild.
- Probability of exploitation in the next 30 days: 0.19% (FIRST EPSS).
- Someone with local access to the system can trigger it. A low-privileged account is enough. No user action is required. No special conditions are required; it is repeatable.
- Fixed version: Linux Linux 1b13b033062824495554e836a1ff5f85ccf6b039, 2.6.33, 2.6.34; azl3 kernel 6.6.96.2-2 on Azure Linux 3.0 6.6.104.2-1; cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0 5.15.200.1-1.
- Severity is disputed: the assigning authority (CNA) scores it 7.8, NVD 5.5.
Low priority for now. Upgrade to Linux Linux 1b13b033062824495554e836a1ff5f85ccf6b039, 2.6.33, 2.6.34; azl3 kernel 6.6.96.2-2 on Azure Linux 3.0 6.6.104.2-1; cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0 5.15.200.1-1 or later.
Generated automatically from the record's data: CVSS (NVD and CNA), CISA KEV and SSVC, FIRST EPSS, exploit sources, fixed versions. How we calculate it
Primary sources: NVD · CVE.org · FIRST EPSS
In the Linux kernel, the following vulnerability has been resolved: eventpoll: Fix semi-unbounded recursion Ensure that epoll instances can never form a graph deeper than EP_MAX_NESTS+1 links. Currently, ep_loop_check_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons: - They don't look upwards in the tree. - If there are multiple downwards paths of different lengths, only one of the paths is actually considered for the depth check since commit 28d82dc1c4ed ("epoll: limit paths"). Essentially, the current recursion depth check in ep_loop_check_proc() just serves to prevent it from recursing too deeply while checking for loops. A more thorough check is done in reverse_path_check() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files. As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").) To fix it: 1. In ep_loop_check_proc(), note the subtree depth of each visited node, and use subtree depths for the total depth calculation even when a subtree has already been visited. 2. Add ep_get_upwards_depth_proc() for similarly determining the maximum depth of an upwards walk. 3. In ep_loop_check(), use these values to limit the total path length between epoll nodes to EP_MAX_NESTS edges.
- Published
- Aug 19, 2025
- Updated
- Nov 10, 2026
- EPSS
- 0.1% · 9th percentile
- CWE
- CWE-674
Report tools
Action score
22
Low priority for now.
- CVSS
- 22 / 40 · 5.5 / 10
- CISA KEV
- 0 / 30 · Not listed
- EPSS
- 0 / 30 · 0.1%
CISA SSVC decision
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
Vulnrichment: CISA's decision-tree inputs.
CNA vs NVD score
- NVD
- 5.5
- CNA · Linux
- 7.8
- 2.3 point gap
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The score given by the assigning authority versus NVD’s independent score. A gap means the severity is contested.
Get told when this record changes
- Not in KEV: no record of exploitation in the wild
- No public exploit code on record
- A fix has been released
If any of these changes, we'll tell you in the daily email digest.
Is your version affected? Check itNoroxi analysis
What does it mean in your environment?
The assessment above is generated automatically from the record's data; it doesn't know your environment. Our team verifies on your systems whether this vulnerability is actually exploitable and which mitigation is enough.
We use this product, ask for helpAffected systems
Is your version affected?
Pick the product and type the version you run. It's compared with this record's version ranges in your browser; the version isn't sent anywhere.
| Vendor | Product | CPE |
|---|---|---|
| linux | linux kernel | cpe:2.3:o:linux:linux_kernel |
| debian | debian linux | cpe:2.3:o:debian:debian_linux |
Versions reported by the vendor
Affected version ranges reported by the assigning authority (Linux). Independent of NVD's CPE analysis and usually ahead of it.
Linux Linux
- 8216e1a0d47cae06a75c42346f19dffe14e42d57, 28a92748aa4bc57d35e7b079498b0ac2e7610a37, 7eebcd4792c5a341559aed327b6afecbb1c46402, 0eccd188cfeaf857a26f2d72941d27d298cf6a54, a72affdbb09f3f24f64ffcbbdf62c2e57c58f379, 2.6.38affected
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before 71379495ab70eaba19224bd71b5b9b399eb85e04affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before 1b13b033062824495554e836a1ff5f85ccf6b039affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before 2a0c0c974bea9619c6f41794775ae4b97530e0e6affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before 7a2125962c42d5336ca0495a9ce4cb38a63e9161affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before 3542c90797bc3ab83ebab54b737d751cf3682036affected · git
- 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e and later · before f2e467a48287c868818085aa35389a224d226732affected · git
- 2.6.32.30 and later · before 2.6.33affected · semver
- 2.6.33.8 and later · before 2.6.34affected · semver
Affected versions · NVD (13)
NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.
- debian debian linux11.0
- linux linux kernel2.6.33.8 and later · before 2.6.34
- linux linux kernel2.6.34.10 and later · before 2.6.35
- linux linux kernel2.6.35.12 and later · before 2.6.36
- linux linux kernel2.6.37.3 and later · before 2.6.38
- linux linux kernel2.6.38.1 and later · before 5.15.190
- linux linux kernel2.6.32.30 and later · before 2.6.33
- linux linux kernel6.2 and later · before 6.6.103
- linux linux kernel6.7 and later · before 6.12.43
- linux linux kernel6.13 and later · before 6.15.11
- linux linux kernel6.16 and later · before 6.16.1
- linux linux kernel5.16 and later · before 6.1.149
- linux linux kernel2.6.38
Package-level exposure
OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.
| Ecosystem | Package | Affected range | Fix |
|---|---|---|---|
| AlmaLinux:10 | kernel-abi-stablelists | before 6.12.0-55.40.1.el10_0 | 6.12.0-55.40.1.el10_0 |
| AlmaLinux:10 | kernel-doc | before 6.12.0-55.40.1.el10_0 | 6.12.0-55.40.1.el10_0 |
| AlmaLinux:9 | kernel | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-devel-matched | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-debug-modules-extra | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-devel-matched | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-64k-modules-extra | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-abi-stablelists | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-cross-headers | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-debug | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-debug-core | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
| AlmaLinux:9 | kernel-debug-devel-matched | before 5.14.0-570.52.1.el9_6 | 5.14.0-570.52.1.el9_6 |
+96
Same product
linux: all recordsOther highest-scoring records for the same primary product.
- CVE-2026-31431crypto: algif_aead - Revert to operating out-of-placeKEV90Now
- CVE-2022-0847A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe…KEV89Now
- CVE-2021-22555Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACEKEV85Now
Published before and after this one in the same product
- ← EarlierCVE-2025-38608Aug 19, 2025 · bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls22Monitor
- ← EarlierCVE-2025-38609Aug 19, 2025 · PM / devfreq: Check governor before using governor->name22Monitor
- Later →CVE-2025-38615Aug 19, 2025 · fs/ntfs3: cancle set bad inode after removing name fails22Monitor
Remediation
Which version to upgrade to
Fix versions compiled from the vendor, package registries and Microsoft. Verify the vendor's note before upgrading.
| Product / package | Fixed version | Source |
|---|---|---|
| Linux Linux | 1b13b033062824495554e836a1ff5f85ccf6b039 | Vendor (CNA) |
| Linux Linux | 2.6.33 | Vendor (CNA) |
| Linux Linux | 2.6.34 | Vendor (CNA) |
| Linux Linux | 2.6.35 | Vendor (CNA) |
| Linux Linux | 2.6.36 | Vendor (CNA) |
| Linux Linux | 2.6.38 | Vendor (CNA) |
| Linux Linux | 2a0c0c974bea9619c6f41794775ae4b97530e0e6 | Vendor (CNA) |
| Linux Linux | 3542c90797bc3ab83ebab54b737d751cf3682036 | Vendor (CNA) |
| Linux Linux | 71379495ab70eaba19224bd71b5b9b399eb85e04 | Vendor (CNA) |
| Linux Linux | 7a2125962c42d5336ca0495a9ce4cb38a63e9161 | Vendor (CNA) |
| Linux Linux | ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6 | Vendor (CNA) |
| Linux Linux | f2e467a48287c868818085aa35389a224d226732 | Vendor (CNA) |
| azl3 kernel 6.6.96.2-2 on Azure Linux 3.0 | 6.6.104.2-1 · CBL-Mariner Releases | Microsoft (MSRC) |
| cbl2 kernel 5.15.186.1-1 on CBL Mariner 2.0 | 5.15.200.1-1 · CBL-Mariner Releases | Microsoft (MSRC) |
| almalinux:kernel | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-core | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-core | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-devel | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-devel-matched | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules-core | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-debug-modules-extra | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-devel | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| almalinux:kernel-64k-devel-matched | 5.14.0-570.52.1.el9_6 · AlmaLinux:9 | Package registry (OSV) |
| debian:linux | 6.1.153-1 · Debian:12 | Package registry (OSV) |
| red hat:kernel-64k-debug-debuginfo | 0:5.14.0-570.52.1.el9_6 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
| red hat:kernel-64k-debug-devel | 0:5.14.0-570.52.1.el9_6 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
| red hat:kernel-64k-debug-devel-matched | 0:5.14.0-570.52.1.el9_6 · Red Hat:enterprise_linux:9::appstream | Package registry (OSV) |
+10
Exploit status
No known public exploit
No public exploit has been observed yet. That doesn't mean you're safe, only that the bar is a little higher.
Research context
For pentesters and researchers: attack profile, score disagreement, timeline, patch commits, credits, variant and chain candidates, bug bounty scope. All derived from existing data; no exploit code.
Timeline
From publication to today: proof of concept, Metasploit module, CISA KEV and fix record. Dates are as reported by the sources.
No dated events beyond publication.
Variant candidates
Same product, same weakness class, within 18 months. If the patch missed the root cause, the sibling bug is here.
- CVE-2026-43185260 days apartksmbd: fix signededness bug in smb_direct_prepare_negotiation()39Monitor
- CVE-2025-3845925 days apartatm: clip: Fix infinite recursive call of clip_push().31Monitor
- CVE-2026-53202310 days apartaccel/ivpu: Fix signed integer truncation in IPC receive31Monitor
- CVE-2026-53267310 days apartnetfilter: nft_ct: bail out on template ct in get eval31Monitor
- CVE-2024-35886457 days apartipv6: Fix infinite recursion in fib6_dump_done().31Monitor
- CVE-2026-53395334 days apartnfsd: fix dead ACL conflict guard in nfsd4_create30Monitor
Not on record for this CVE: EPSS history · patch commit or PR link · researcher credit · public bounty program.
Technical details
Attack conditions
- Someone with local access to the system can trigger it.
- A low-privileged account is enough.
- No user action is required.
- No special conditions are required; it is repeatable.
If successful
- Confidentiality
- none
- Integrity
- none
- Availability
- high · the service can be disrupted
- Attack vector
- Local
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality impact
- None
- Integrity impact
- None
- Availability impact
- High
Weakness class (CWE)
CWE-674 · Uncontrolled RecursionCVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvd-primary
Attack context
MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.
Attack patterns (CAPEC)
ATT&CK techniques
—
Change log (2)
- SSVC exploitation— → none
- Fix✗ → ✓
For records you follow, these changes also arrive as notifications. →
References
Show all references (11 more)Show less
- git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6
- git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036
- git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04
- git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161
- git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6
- git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732
- lists.debian.org/debian-lts-announce/2025/10/msg00008.html
- cert-portal.siemens.com/productcert/html/ssa-019113.html
- cert-portal.siemens.com/productcert/html/ssa-032379.html
- cert-portal.siemens.com/productcert/html/ssa-082556.html
- cert-portal.siemens.com/productcert/html/ssa-457936.html
Vendor advisories and official records. Exploit/PoC links are deliberately left out.