In the Linux kernel, the following vulnerability has been resolved:
eventpoll: Fix semi-unbounded recursion
Ensure that epoll instances can never form a graph deeper than EPMAXNESTS+1 links.
Currently, eploopcheck_proc() ensures that the graph is loop-free and does some recursion depth checks, but those recursion depth checks don't limit the depth of the resulting tree for two reasons:
Essentially, the current recursion depth check in eploopcheck_proc() just serves to prevent it from recursing too deeply while checking for loops.
A more thorough check is done in reversepathcheck() after the new graph edge has already been created; this checks, among other things, that no paths going upwards from any non-epoll file with a length of more than 5 edges exist. However, this check does not apply to non-epoll files.
As a result, it is possible to recurse to a depth of at least roughly 500, tested on v6.15. (I am unsure if deeper recursion is possible; and this may have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion problem").)
To fix it:
[
{
"id": "CVE-2025-38614-0069f3ed",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"171555876275327149264471788404921975336",
"227337019715829548493464425149296360941",
"253280755657850757641871164596016473931",
"132101509343724088655778564652406940278",
"194251815196505815529974322106495231268",
"207746496721788773990675186268901921106",
"214127217917977492597378672061333905050",
"194068413028206905191105009989997851527",
"223231486411389885207065559161906913302",
"277430288848200337882240728315391817728",
"121307854256850725572502166579433263111",
"158488226944055160066746510649521014821",
"37875210959649975796171427099905245634",
"17216542004077653367343445252304697164",
"29089642051332920435705957184300732575",
"228700186639012720071953220274941042670",
"288484941904076415698420153761333036232",
"167545079370722665055133914676927866096",
"314964422435721238328487562961412055361",
"236282614692877571273752038414555851093",
"175596896670702233805842369195802139288",
"171418452305993791165254214771674942537",
"257787060685068205056196964717293260102",
"171047849634083099349659673559101713488",
"20981657406841248172153670681594126444",
"30224143277523602966178239224650425149",
"213382896601475936367041946670723582767",
"118675912655364562131051871387498788427",
"248248246477951490285508361128648164304",
"296333232157102187561658475721944399874",
"246942643078351487920312202642021021590",
"18104290032206608664266559878675129169",
"179643128116180401173431899370410109929"
],
"threshold": 0.9
},
"target": {
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2e467a48287c868818085aa35389a224d226732",
"deprecated": false
},
{
"id": "CVE-2025-38614-10a7fe21",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 665.0,
"function_hash": "315604482704033361913804049046124833414"
},
"target": {
"function": "ep_loop_check_proc",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a0c0c974bea9619c6f41794775ae4b97530e0e6",
"deprecated": false
},
{
"id": "CVE-2025-38614-2c36f722",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 116.0,
"function_hash": "4349305813411545071065916482195829153"
},
"target": {
"function": "ep_loop_check",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3542c90797bc3ab83ebab54b737d751cf3682036",
"deprecated": false
},
{
"id": "CVE-2025-38614-2efe1c1d",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 665.0,
"function_hash": "315604482704033361913804049046124833414"
},
"target": {
"function": "ep_loop_check_proc",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6",
"deprecated": false
},
{
"id": "CVE-2025-38614-38e4dce6",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 665.0,
"function_hash": "315604482704033361913804049046124833414"
},
"target": {
"function": "ep_loop_check_proc",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2e467a48287c868818085aa35389a224d226732",
"deprecated": false
},
{
"id": "CVE-2025-38614-5c175017",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 665.0,
"function_hash": "315604482704033361913804049046124833414"
},
"target": {
"function": "ep_loop_check_proc",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3542c90797bc3ab83ebab54b737d751cf3682036",
"deprecated": false
},
{
"id": "CVE-2025-38614-70e4027e",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"171555876275327149264471788404921975336",
"227337019715829548493464425149296360941",
"253280755657850757641871164596016473931",
"132101509343724088655778564652406940278",
"194251815196505815529974322106495231268",
"207746496721788773990675186268901921106",
"214127217917977492597378672061333905050",
"194068413028206905191105009989997851527",
"223231486411389885207065559161906913302",
"277430288848200337882240728315391817728",
"121307854256850725572502166579433263111",
"158488226944055160066746510649521014821",
"37875210959649975796171427099905245634",
"17216542004077653367343445252304697164",
"29089642051332920435705957184300732575",
"228700186639012720071953220274941042670",
"288484941904076415698420153761333036232",
"167545079370722665055133914676927866096",
"314964422435721238328487562961412055361",
"236282614692877571273752038414555851093",
"175596896670702233805842369195802139288",
"171418452305993791165254214771674942537",
"257787060685068205056196964717293260102",
"171047849634083099349659673559101713488",
"20981657406841248172153670681594126444",
"30224143277523602966178239224650425149",
"213382896601475936367041946670723582767",
"118675912655364562131051871387498788427",
"248248246477951490285508361128648164304",
"296333232157102187561658475721944399874",
"246942643078351487920312202642021021590",
"18104290032206608664266559878675129169",
"179643128116180401173431899370410109929"
],
"threshold": 0.9
},
"target": {
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6",
"deprecated": false
},
{
"id": "CVE-2025-38614-911437c7",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 116.0,
"function_hash": "4349305813411545071065916482195829153"
},
"target": {
"function": "ep_loop_check",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f2e467a48287c868818085aa35389a224d226732",
"deprecated": false
},
{
"id": "CVE-2025-38614-97ed623b",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"171555876275327149264471788404921975336",
"227337019715829548493464425149296360941",
"253280755657850757641871164596016473931",
"132101509343724088655778564652406940278",
"194251815196505815529974322106495231268",
"207746496721788773990675186268901921106",
"214127217917977492597378672061333905050",
"194068413028206905191105009989997851527",
"223231486411389885207065559161906913302",
"277430288848200337882240728315391817728",
"121307854256850725572502166579433263111",
"158488226944055160066746510649521014821",
"37875210959649975796171427099905245634",
"17216542004077653367343445252304697164",
"29089642051332920435705957184300732575",
"228700186639012720071953220274941042670",
"288484941904076415698420153761333036232",
"167545079370722665055133914676927866096",
"314964422435721238328487562961412055361",
"236282614692877571273752038414555851093",
"175596896670702233805842369195802139288",
"171418452305993791165254214771674942537",
"257787060685068205056196964717293260102",
"171047849634083099349659673559101713488",
"20981657406841248172153670681594126444",
"30224143277523602966178239224650425149",
"213382896601475936367041946670723582767",
"118675912655364562131051871387498788427",
"248248246477951490285508361128648164304",
"296333232157102187561658475721944399874",
"246942643078351487920312202642021021590",
"18104290032206608664266559878675129169",
"179643128116180401173431899370410109929"
],
"threshold": 0.9
},
"target": {
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3542c90797bc3ab83ebab54b737d751cf3682036",
"deprecated": false
},
{
"id": "CVE-2025-38614-b35d98e7",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 116.0,
"function_hash": "4349305813411545071065916482195829153"
},
"target": {
"function": "ep_loop_check",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6",
"deprecated": false
},
{
"id": "CVE-2025-38614-c60ce6f4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 116.0,
"function_hash": "4349305813411545071065916482195829153"
},
"target": {
"function": "ep_loop_check",
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a0c0c974bea9619c6f41794775ae4b97530e0e6",
"deprecated": false
},
{
"id": "CVE-2025-38614-d62716c6",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"171555876275327149264471788404921975336",
"227337019715829548493464425149296360941",
"253280755657850757641871164596016473931",
"132101509343724088655778564652406940278",
"194251815196505815529974322106495231268",
"207746496721788773990675186268901921106",
"214127217917977492597378672061333905050",
"194068413028206905191105009989997851527",
"223231486411389885207065559161906913302",
"277430288848200337882240728315391817728",
"121307854256850725572502166579433263111",
"158488226944055160066746510649521014821",
"37875210959649975796171427099905245634",
"17216542004077653367343445252304697164",
"29089642051332920435705957184300732575",
"228700186639012720071953220274941042670",
"288484941904076415698420153761333036232",
"167545079370722665055133914676927866096",
"314964422435721238328487562961412055361",
"236282614692877571273752038414555851093",
"175596896670702233805842369195802139288",
"171418452305993791165254214771674942537",
"257787060685068205056196964717293260102",
"171047849634083099349659673559101713488",
"20981657406841248172153670681594126444",
"30224143277523602966178239224650425149",
"213382896601475936367041946670723582767",
"118675912655364562131051871387498788427",
"248248246477951490285508361128648164304",
"296333232157102187561658475721944399874",
"246942643078351487920312202642021021590",
"18104290032206608664266559878675129169",
"179643128116180401173431899370410109929"
],
"threshold": 0.9
},
"target": {
"file": "fs/eventpoll.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2a0c0c974bea9619c6f41794775ae4b97530e0e6",
"deprecated": false
}
]