# CVE-2025-38614: eventpoll: Fix semi-unbounded recursion

> A flaw in the Linux kernel's eventpoll subsystem allows semi-unbounded recursion, potentially leading to a denial of service.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 19 Aug 2025
- **Updated:** 15 Oct 2026
- **Also known as:** AZL-66533, AZL-73878, BELL-CVE-2025-38614, DEBIAN-CVE-2025-38614, GHSA-grcg-mgx8-mfvf, ROOT-OS-DEBIAN-11-CVE-2025-38614, ROOT-OS-DEBIAN-12-CVE-2025-38614, ROOT-OS-DEBIAN-13-CVE-2025-38614, ROOT-OS-UBUNTU-2204-CVE-2025-38614, ROOT-OS-UBUNTU-2404-CVE-2025-38614, UBUNTU-CVE-2025-38614

## What is CVE-2025-38614?

CVE-2025-38614 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

eventpoll: Fix semi-unbounded recursion

Ensure that epoll instances can never form a graph deeper than
EP_MAX_NESTS+1 links.

Currently, ep_loop_check_proc() ensures that the graph is loop-free and
does some recursion depth checks, but those recursion depth checks don't
limit the depth of the resulting tree for two reasons:

 - They don't look upwards in the tree.
 - If there are multiple downwards paths of different lengths, only one of
   the paths is actually considered for the depth check since commit
   28d82dc1c4ed ("epoll: limit paths").

Essentially, the current recursion depth check in ep_loop_check_proc() just
serves to prevent it from recursing too deeply while checking for loops.

A more thorough check is done in reverse_path_check() after the new graph
edge has already been created; this checks, among other things, that no
paths going upwards from any non-epoll file with a length of more than 5
edges exist. However, this check does not apply to non-epoll files.

As a result, it is possible to recurse to a depth of at least roughly 500,
tested on v6.15. (I am unsure if deeper recursion is possible; and this may
have changed with commit 8c44dac8add7 ("eventpoll: Fix priority inversion
problem").)

To fix it:

1. In ep_loop_check_proc(), note the subtree depth of each visited node,
and use subtree depths for the total depth calculation even when a subtree
has already been visited.
2. Add ep_get_upwards_depth_proc() for similarly determining the maximum
depth of an upwards walk.
3. In ep_loop_check(), use these values to limit the total path length
between epoll nodes to EP_MAX_NESTS edges.

Weakness: CWE-674 (Uncontrolled Recursion)

## Which versions are affected by CVE-2025-38614?

It affects 2 products.


Products: Debian Debian Linux, Linux kernel.

## How do I fix CVE-2025-38614?

Apply the vendor's patch.

## Is CVE-2025-38614 being exploited?

There is no known exploitation of CVE-2025-38614 in the wild and no public exploit code.

## Other vulnerabilities in Debian Debian Linux

- [CVE-2015-3306](https://insights.sbomify.com/CVE-2015-3306/): ProFTPD Improper Access Control (critical 10.0, exploited in the wild)
- [CVE-2025-49113](https://insights.sbomify.com/CVE-2025-49113/): RoundCube Webmail Deserialization of Untrusted Data (critical 9.9, exploited in the wild)
- [CVE-2026-24061](https://insights.sbomify.com/CVE-2026-24061/): GNU InetUtils Argument Injection (critical 9.8, exploited in the wild)
- [CVE-2025-39682](https://insights.sbomify.com/CVE-2025-39682/): Linux Kernel Improper Check for Unusual or Exceptional Conditions (critical 9.8, exploited in the wild)
- [CVE-2024-9680](https://insights.sbomify.com/CVE-2024-9680/): Mozilla Firefox Use-After-Free (critical 9.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2025-38614 and fix it if it is affected.

What it is: CVE-2025-38614 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 19 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2025-38614 in the wild and no public exploit code.

Affected product: Debian Debian Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2025-38614/ (Markdown: https://insights.sbomify.com/CVE-2025-38614/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2025-38614
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-38614
- OSV: https://osv.dev/vulnerability/CVE-2025-38614

---
From sbomify Insights: https://insights.sbomify.com/CVE-2025-38614/
Summaries are generated and may contain mistakes; the official description above is the record.