PT-2025-30016 · Linux+5 · Linux Kernel+5
Jann Horn
·
Published
2025-07-09
·
Updated
2026-05-26
·
CVE-2025-38349
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A flaw exists in the Linux kernel's eventpoll implementation where the epoll reference count is decremented while still holding the ep mutex. This can lead to a use-after-free condition. The issue arises because the decrementing of the reference count before unlocking the mutex allows another user to free the epoll structure while the mutex is still being accessed, potentially leading to a crash or unpredictable behavior. Mutexes do not guarantee object ownership, and a mutex unlock operation is not atomic, creating a race condition.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Debian
Linuxmint
Linux Kernel
Rocky Linux
Suse
Ubuntu