SECUFOCUSNOW
Home›CVE index›CVE-2025-38349
Review reviewHigh

CVE-2025-38349

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine for the very last reference, because the code in question will delay the actual call to "ep_free(ep)" until after it has unlocked the mutex. But it's wrong for the much subtler "next to last" case when somebody *else* may also be dropping their refer...

CVSS
7.8
EPSS
0.15%
4.96% percentile
CISA KEV
Not listed
Published
2025.07.18
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.15%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine for the very last reference, because the code in question will delay the actual call to "ep_free(ep)" until after it has unlocked the mutex. But it's wrong for the much subtler "next to last" case when somebody *else* may also be dropping their refer...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= a1f93804449d13f97dabd4b996817de4bf1ed67a < b0821ec902d39062356cb644c16e17a705d1c9f5, >= 58c9b016e12855286370dfb704c08498edbc857a < 521e9ff0b67c66a17d6f9593dfccafaa984aae4c, >= 58c9b016e12855286370dfb704c08498edbc857a < 6dee745bd0aec9d399df674256e7b1ecdb615444, >= 58c9b016e12855286370dfb704c08498edbc857a < 605c18698ecfa99165f36b7f59d3ed503e169814, >= 58c9b016e12855286370dfb704c08498edbc857a < 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2, >= f2451def095c1743adcfcb0cb5dadc86034e162a, >= 6.1.175 < 6.1.178, >= 5.15.209 < 5.16, >= 6.4, >= 6.4 < 6.6.99, >= 6.7 < 6.12.39, >= 6.13 < 6.15.7, 6.16
Fixed versions
6.6.99, 6.12.39, 6.15.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416