PT-2025-25792 · Linux+1 · Linux Kernel+1

Published 2025-04-29 · Updated 2025-06-19 · CVE-2025-38017

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the Linux kernel's eventpoll functionality, where an endless busy loop can occur after a timeout has expired. This happens because the given timeout usually expires before the ep poll function is entered, and the timed out variable is never set. This can lead to a soft lockup, RCU stalls, and deadlocks, causing severe system issues. The problem arises from the ep schedule timeout check being skipped, and the timed out variable not being set when the timeout has expired.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

BDU:2025-09043

CVE-2025-38017

Affected Products

Astra Linux

Linux Kernel

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38017.json · Exploit
• https://git.kernel.org/stable/c/d9ec73301099ec5975505e1c3effbe768bab9490 · Patch
• https://osv.dev/vulnerability/CVE-2025-38017 · Vendor Advisory
• https://git.kernel.org/stable/c/7631dca012593c95d36199082546a24a0058fc50 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-38017 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-38017 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-38017 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09043 · Security Note
• https://ubuntu.com/security/CVE-2025-38017 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-38017 · Security Note
• https://cybersecurity-help.cz/vdb/SB2025062095 · Note
• https://git.kernel.org/linus/d9ec73301099ec5975505e1c3effbe768bab9490 · Note
• https://access.redhat.com/security/cve/cve-2025-38017 · Note
• https://lore.kernel.org/linux-cve-announce/2025061844-CVE-2025-38017-16a2@gregkh · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note