eventpoll: don't decrement ep refcount while still holding the ep mutex

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2025-38349
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2025-07-18 08:15:27 UTC
Updated2026-07-24 15:16:56 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a mutex_unlock(&ep->mtx); afterwards. That's very wrong, because it can lead to a use-after-free. That pattern is actually fine for the very last reference, because the code in question will delay the actual call to "ep_free(ep)" until after it has unlocked the mutex. But it's wrong for the much subtler "next to last" case when somebody *else* may also be dropping their reference and free the ep while we're still using the mutex. Note that this is true even if that other user is also using the same ep mutex: mutexes, unlike spinlocks, can not be used for object ownership, even if they guarantee mutual exclusion. A mutex "unlock" operation is not atomic, and as one user is still accessing the mutex as part of unlocking it, another user can come in and get the now released mutex and free the data structure while the first user is still cleaning up. See our mutex documentation in Documentation/locking/mutex-design.rst, in particular the section [1] about semantics: "mutex_unlock() may access the mutex structure even after it has internally released the lock already - so it's not safe for another context to acquire the mutex and assume that the mutex_unlock() context is not using the structure anymore" So if we drop our ep ref before the mutex unlock, but we weren't the last one, we may then unlock the mutex, another user comes in, drops _their_ reference and releases the 'ep' as it now has no users - all while the mutex_unlock() is still accessing it. Fix this by simply moving the ep refcount dropping to outside the mutex: the refcount itself is atomic, and doesn't need mutex protection (that's the whole _point_ of refcounts: unlike mutexes, they are inherently about object lifetimes).

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from [email protected]

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem Types: CWE-416

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected a1f93804449d13f97dabd4b996817de4bf1ed67a b0821ec902d39062356cb644c16e17a705d1c9f5 git Not specified
CNA Linux Linux affected 58c9b016e12855286370dfb704c08498edbc857a 521e9ff0b67c66a17d6f9593dfccafaa984aae4c git Not specified
CNA Linux Linux affected 58c9b016e12855286370dfb704c08498edbc857a 6dee745bd0aec9d399df674256e7b1ecdb615444 git Not specified
CNA Linux Linux affected 58c9b016e12855286370dfb704c08498edbc857a 605c18698ecfa99165f36b7f59d3ed503e169814 git Not specified
CNA Linux Linux affected 58c9b016e12855286370dfb704c08498edbc857a 8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2 git Not specified
CNA Linux Linux affected f2451def095c1743adcfcb0cb5dadc86034e162a git Not specified
CNA Linux Linux affected 6.1.175 6.1.178 semver Not specified
CNA Linux Linux affected 5.15.209 5.16 semver Not specified
CNA Linux Linux affected 6.4 Not specified
CNA Linux Linux unaffected 6.4 semver Not specified
CNA Linux Linux unaffected 6.1.178 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.99 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.39 6.12.* semver Not specified
CNA Linux Linux unaffected 6.15.7 6.15.* semver Not specified
CNA Linux Linux unaffected 6.16 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/521e9ff0b67c66a17d6f9593dfccafaa984aae4c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/b0821ec902d39062356cb644c16e17a705d1c9f5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6dee745bd0aec9d399df674256e7b1ecdb615444 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
git.kernel.org/stable/c/8c2e52ebbe885c7eeaabd3b7ddcdc1246fc400d2 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
project-zero.issues.chromium.org/issues/430541637 416baaa9-dc9f-4396-8d5f-8c081fb06d67 project-zero.issues.chromium.org Issue Tracking, Patch
git.kernel.org/stable/c/605c18698ecfa99165f36b7f59d3ed503e169814 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org Patch
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report