CVE-2025-38614

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: Fix semi-unbounded recursion

Ensure that epoll instances can never form a graph deeper than

EP_MAX_NESTS+1 links.

Currently, ep_loop_check_proc() ensures that the graph is loop-free and

does some recursion depth checks, but those recursion depth checks don't

limit the depth of the resulting tree for two reasons:

- They don't look upwards in the tree.

- If there are multiple downwards paths of different lengths, only one of

the paths is actually considered for the depth check since commit

28d82dc1c4ed ("epoll: limit paths").

Essentially, the current recursion depth check in ep_loop_check_proc() just

serves to prevent it from recursing too deeply while checking for loops.

A more thorough check is done in reverse_path_check() after the new graph

edge has already been created; this checks, among other things, that no

paths going upwards from any non-epoll file with a length of more than 5

edges exi

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References