{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2025-38614", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2025-38614", "idYear": 2025, "status": "PUBLISHED", "publishedAt": "2025-08-19T17:03:56.348Z", "updatedAt": "2026-10-15T22:02:26.774Z", "importedAt": "2026-10-24T01:57:34.152Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "eventpoll: Fix semi-unbounded recursion", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n the paths is actually considered for the depth check since commit\n 28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "71379495ab70eaba19224bd71b5b9b399eb85e04" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "1b13b033062824495554e836a1ff5f85ccf6b039" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "2a0c0c974bea9619c6f41794775ae4b97530e0e6" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "7a2125962c42d5336ca0495a9ce4cb38a63e9161" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "3542c90797bc3ab83ebab54b737d751cf3682036" }, { "version": "22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e", "status": "affected", "versionType": "git", "lessThan": "f2e467a48287c868818085aa35389a224d226732" }, { "version": "8216e1a0d47cae06a75c42346f19dffe14e42d57", "status": "affected", "versionType": "git" }, { "version": "28a92748aa4bc57d35e7b079498b0ac2e7610a37", "status": "affected", "versionType": "git" }, { "version": "7eebcd4792c5a341559aed327b6afecbb1c46402", "status": "affected", "versionType": "git" }, { "version": "0eccd188cfeaf857a26f2d72941d27d298cf6a54", "status": "affected", "versionType": "git" }, { "version": "a72affdbb09f3f24f64ffcbbdf62c2e57c58f379", "status": "affected", "versionType": "git" }, { "version": "2.6.32.30", "status": "affected", "versionType": "semver", "lessThan": "2.6.33" }, { "version": "2.6.33.8", "status": "affected", "versionType": "semver", "lessThan": "2.6.34" }, { "version": "2.6.34.10", "status": "affected", "versionType": "semver", "lessThan": "2.6.35" }, { "version": "2.6.35.12", "status": "affected", "versionType": "semver", "lessThan": "2.6.36" }, { "version": "2.6.37.3", "status": "affected", "versionType": "semver", "lessThan": "2.6.38" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "2.6.38", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "2.6.38" }, { "version": "5.15.190", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.149", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.103", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.43", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.15.11", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.15.*" }, { "version": "6.16.1", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.16.*" }, { "version": "6.17", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }