{"api_version":"1","generated_at":"2026-07-23T15:16:32+00:00","cve":"CVE-2025-38614","urls":{"html":"https://cve.report/CVE-2025-38614","api":"https://cve.report/api/cve/CVE-2025-38614.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2025-38614","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2025-38614"},"summary":{"title":"eventpoll: Fix semi-unbounded recursion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n   the paths is actually considered for the depth check since commit\n   28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.","state":"PUBLISHED","assigner":"Linux","published_at":"2025-08-19 17:15:40","updated_at":"2026-07-14 13:17:41"},"problem_types":["CWE-674"],"metrics":[{"version":"3.1","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"}}],"references":[{"url":"https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6","name":"https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","name":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Third Party Advisory"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161","name":"https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04","name":"https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039","name":"https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6","name":"https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","name":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html","refsource":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732","name":"https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036","name":"https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":["Patch"],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-38614","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38614","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e 71379495ab70eaba19224bd71b5b9b399eb85e04 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e 1b13b033062824495554e836a1ff5f85ccf6b039 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e 2a0c0c974bea9619c6f41794775ae4b97530e0e6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e 7a2125962c42d5336ca0495a9ce4cb38a63e9161 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e 3542c90797bc3ab83ebab54b737d751cf3682036 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e f2e467a48287c868818085aa35389a224d226732 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 8216e1a0d47cae06a75c42346f19dffe14e42d57 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 28a92748aa4bc57d35e7b079498b0ac2e7610a37 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 7eebcd4792c5a341559aed327b6afecbb1c46402 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 0eccd188cfeaf857a26f2d72941d27d298cf6a54 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected a72affdbb09f3f24f64ffcbbdf62c2e57c58f379 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.32.30 2.6.33 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.33.8 2.6.34 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.34.10 2.6.35 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.35.12 2.6.36 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.37.3 2.6.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 2.6.38","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 2.6.38 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.15.190 5.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.1.149 6.1.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.6.103 6.6.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.12.43 6.12.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.15.11 6.15.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.16.1 6.16.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.17 * original_commit_for_fix","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC CN 4100","version":"affected V5.0 custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.5 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.5 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.5 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.5 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.5 * custom","platforms":[]},{"source":"ADP","vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","version":"affected V3.1.6 * custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2025","cve_id":"38614","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2025-11-03T17:40:26.593Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"url":"https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html"}],"title":"CVE Program Container"},{"affected":[{"defaultStatus":"unknown","product":"SIMATIC CN 4100","vendor":"Siemens","versions":[{"lessThan":"V5.0","status":"affected","version":"0","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.5","versionType":"custom"}]},{"defaultStatus":"unknown","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","vendor":"Siemens","versions":[{"lessThan":"*","status":"affected","version":"V3.1.6","versionType":"custom"}]}],"providerMetadata":{"dateUpdated":"2026-07-14T12:42:16.833Z","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","shortName":"siemens-SADP"},"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-032379.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}],"x_adpType":"supplier"}],"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"71379495ab70eaba19224bd71b5b9b399eb85e04","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"1b13b033062824495554e836a1ff5f85ccf6b039","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"2a0c0c974bea9619c6f41794775ae4b97530e0e6","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"7a2125962c42d5336ca0495a9ce4cb38a63e9161","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"3542c90797bc3ab83ebab54b737d751cf3682036","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"lessThan":"f2e467a48287c868818085aa35389a224d226732","status":"affected","version":"22bacca48a1755f79b7e0f192ddb9fbb7fc6e64e","versionType":"git"},{"status":"affected","version":"8216e1a0d47cae06a75c42346f19dffe14e42d57","versionType":"git"},{"status":"affected","version":"28a92748aa4bc57d35e7b079498b0ac2e7610a37","versionType":"git"},{"status":"affected","version":"7eebcd4792c5a341559aed327b6afecbb1c46402","versionType":"git"},{"status":"affected","version":"0eccd188cfeaf857a26f2d72941d27d298cf6a54","versionType":"git"},{"status":"affected","version":"a72affdbb09f3f24f64ffcbbdf62c2e57c58f379","versionType":"git"},{"lessThan":"2.6.33","status":"affected","version":"2.6.32.30","versionType":"semver"},{"lessThan":"2.6.34","status":"affected","version":"2.6.33.8","versionType":"semver"},{"lessThan":"2.6.35","status":"affected","version":"2.6.34.10","versionType":"semver"},{"lessThan":"2.6.36","status":"affected","version":"2.6.35.12","versionType":"semver"},{"lessThan":"2.6.38","status":"affected","version":"2.6.37.3","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/eventpoll.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.38"},{"lessThan":"2.6.38","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.190","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.149","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.103","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.43","versionType":"semver"},{"lessThanOrEqual":"6.15.*","status":"unaffected","version":"6.15.11","versionType":"semver"},{"lessThanOrEqual":"6.16.*","status":"unaffected","version":"6.16.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"6.17","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"5.15.190","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.149","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.103","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.43","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.15.11","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.16.1","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.17","versionStartIncluding":"2.6.38","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32.30","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33.8","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34.10","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35.12","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n   the paths is actually considered for the depth check since commit\n   28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges."}],"providerMetadata":{"dateUpdated":"2026-05-23T16:00:12.116Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04"},{"url":"https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039"},{"url":"https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6"},{"url":"https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161"},{"url":"https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6"},{"url":"https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036"},{"url":"https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732"}],"title":"eventpoll: Fix semi-unbounded recursion","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2025-38614","datePublished":"2025-08-19T17:03:56.348Z","dateReserved":"2025-04-16T04:51:24.029Z","dateUpdated":"2026-07-14T12:42:16.833Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2025-08-19 17:15:40","lastModifiedDate":"2026-07-14 13:17:41","problem_types":["CWE-674"],"metrics":{"cvssMetricV31":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":3.6}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.32.30","versionEndExcluding":"2.6.33","matchCriteriaId":"A31DF920-9B19-44E2-9306-1A716F41D88F"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.33.8","versionEndExcluding":"2.6.34","matchCriteriaId":"80E63E66-5563-46B5-946B-9B7C1A0F8282"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.34.10","versionEndExcluding":"2.6.35","matchCriteriaId":"9EFAA32D-46AB-476B-AA92-0A44902AA954"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.35.12","versionEndExcluding":"2.6.36","matchCriteriaId":"12F4F63F-6A50-46E5-BCA6-5E1E1209D2EE"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.37.3","versionEndExcluding":"2.6.38","matchCriteriaId":"6D450BD9-CE45-474D-B963-F6F739670A01"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.38.1","versionEndExcluding":"5.15.190","matchCriteriaId":"80A9A918-2CBA-43E8-9291-4F35BCA78B7D"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.16","versionEndExcluding":"6.1.149","matchCriteriaId":"FDBE8280-8983-4D2D-943D-2E6D0104E2D8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.2","versionEndExcluding":"6.6.103","matchCriteriaId":"F2293654-7169-49B5-8D0D-EE51EF8B8E48"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.7","versionEndExcluding":"6.12.43","matchCriteriaId":"472C5F87-2BF3-4FAB-9B21-DA7513977363"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.15.11","matchCriteriaId":"BC242347-F722-43AE-B910-BE0B22386977"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.16.1","matchCriteriaId":"58182352-D7DF-4CC9-841E-03C1D852C3FB"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.38:-:*:*:*:*:*:*","matchCriteriaId":"985DC743-744A-429F-8098-EFCC91DFB6F7"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.38:rc7:*:*:*:*:*:*","matchCriteriaId":"9BBB4630-CBED-43B9-B203-BE65BBF011AA"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:2.6.38:rc8:*:*:*:*:*:*","matchCriteriaId":"FD375A78-63D7-441A-9FB0-7BC878AB4EDD"}]}]},{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*","matchCriteriaId":"FA6FEEC2-9F11-4643-8827-749718254FED"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2025","CveId":"38614","Ordinal":"1","Title":"eventpoll: Fix semi-unbounded recursion","CVE":"CVE-2025-38614","Year":"2025"},"notes":[{"CveYear":"2025","CveId":"38614","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\neventpoll: Fix semi-unbounded recursion\n\nEnsure that epoll instances can never form a graph deeper than\nEP_MAX_NESTS+1 links.\n\nCurrently, ep_loop_check_proc() ensures that the graph is loop-free and\ndoes some recursion depth checks, but those recursion depth checks don't\nlimit the depth of the resulting tree for two reasons:\n\n - They don't look upwards in the tree.\n - If there are multiple downwards paths of different lengths, only one of\n   the paths is actually considered for the depth check since commit\n   28d82dc1c4ed (\"epoll: limit paths\").\n\nEssentially, the current recursion depth check in ep_loop_check_proc() just\nserves to prevent it from recursing too deeply while checking for loops.\n\nA more thorough check is done in reverse_path_check() after the new graph\nedge has already been created; this checks, among other things, that no\npaths going upwards from any non-epoll file with a length of more than 5\nedges exist. However, this check does not apply to non-epoll files.\n\nAs a result, it is possible to recurse to a depth of at least roughly 500,\ntested on v6.15. (I am unsure if deeper recursion is possible; and this may\nhave changed with commit 8c44dac8add7 (\"eventpoll: Fix priority inversion\nproblem\").)\n\nTo fix it:\n\n1. In ep_loop_check_proc(), note the subtree depth of each visited node,\nand use subtree depths for the total depth calculation even when a subtree\nhas already been visited.\n2. Add ep_get_upwards_depth_proc() for similarly determining the maximum\ndepth of an upwards walk.\n3. In ep_loop_check(), use these values to limit the total path length\nbetween epoll nodes to EP_MAX_NESTS edges.","Type":"Description","Title":"eventpoll: Fix semi-unbounded recursion"}]}}}