CVE-2025-38349 Overview
CVE-2025-38349 is a use-after-free vulnerability [CWE-416] in the Linux kernel's eventpoll (epoll) subsystem. The flaw resides in reference counting logic where the code decrements the ep refcount while still holding the ep->mtx mutex. Because mutex unlock operations are not atomic, another thread can acquire the mutex and free the struct eventpoll while the original context is still using it. Jann Horn of Google Project Zero reported the issue. Affected kernels include the 6.16-rc series and prior branches receiving stable backports.
Critical Impact
Local attackers can trigger a race condition in eventpoll to achieve use-after-free, leading to kernel memory corruption, privilege escalation, or full system compromise.
Affected Products
- Linux Kernel 6.16-rc1 through 6.16-rc5
- Linux Kernel stable branches prior to the fix commits
- Distributions shipping vulnerable kernel builds of the eventpoll subsystem
Discovery Timeline
- 2025-07-18 - CVE-2025-38349 published to NVD
- 2026-07-24 - Last updated in NVD database
Technical Details for CVE-2025-38349
Vulnerability Analysis
The vulnerability affects the eventpoll subsystem, which implements the Linux epoll I/O event notification mechanism. The kernel's struct eventpoll (ep) uses a refcount to track object lifetime and a mutex (ep->mtx) for serializing access.
The buggy pattern decrements the ep refcount before calling mutex_unlock(&ep->mtx). Per the kernel's mutex documentation in Documentation/locking/mutex-design.rst, mutex_unlock() may still access the mutex structure after releasing the lock internally. If the refcount decrement is not the last reference, another concurrent context can drop the final reference, invoke ep_free(ep), and free the structure while mutex_unlock() still reads from it. The result is a classic use-after-free in kernel memory.
Root Cause
The root cause is incorrect ordering between refcount management and mutex release. Mutexes provide mutual exclusion but do not guarantee object ownership. Dropping the refcount while still inside the critical section allows a parallel unref to free the object before mutex_unlock() completes its internal bookkeeping. The fix moves the refcount decrement outside the mutex, relying on the atomic nature of refcounts for lifetime management.
Attack Vector
Exploitation requires local access and low privileges. An attacker crafts a workload that opens epoll file descriptors and triggers concurrent close or teardown paths that race the vulnerable unlock sequence. Winning the race corrupts kernel heap objects allocated in the same slab as struct eventpoll, enabling privilege escalation to root. The vulnerability was reported through Google Project Zero (see Chromium Project Zero Issue 430541637).
Detection Methods for CVE-2025-38349
Indicators of Compromise
- Unexpected kernel oops or general protection fault messages referencing ep_free, ep_clear_and_put, or eventpoll symbols in dmesg
- KASAN reports flagging use-after-free reads or writes on struct eventpoll allocations
- Unexplained privilege escalation events on multi-threaded workloads that heavily use epoll_create, epoll_ctl, and close
Detection Strategies
- Enable KASAN and lockdep in test builds to surface the use-after-free at runtime
- Audit installed kernel versions against fixed commits 521e9ff0b67c, 605c18698ecf, 6dee745bd0ae, 8c2e52ebbe88, and b0821ec902d3
- Monitor kernel logs for repeated epoll-related crashes originating from unprivileged processes
Monitoring Recommendations
- Aggregate kernel crash telemetry from endpoints and correlate with local user activity
- Track syscall patterns showing rapid epoll_create1 and close from the same low-privilege UID
- Alert on new SUID execution or unexpected root shells following crash events on Linux hosts
How to Mitigate CVE-2025-38349
Immediate Actions Required
- Update to a Linux kernel version containing one of the fix commits listed in the vendor advisories
- Prioritize patching multi-tenant Linux hosts, container hosts, and shared developer systems where local access is available
- Restrict local shell access on production systems until patches are deployed
Patch Information
The fix moves the ep refcount drop outside the ep->mtx critical section. Fix commits are available at Linux Kernel Commit 521e9ff, Linux Kernel Commit 605c186, Linux Kernel Commit 6dee745, Linux Kernel Commit 8c2e52e, and Linux Kernel Commit b0821ec. Apply distribution vendor updates as they become available.
Workarounds
- No supported configuration workaround exists; patching is the only reliable remediation
- Reduce risk by limiting untrusted local users and disabling unnecessary shell access
- Enforce seccomp or namespace restrictions on workloads that do not require epoll heavy usage
# Verify running kernel version and check for fixed build
uname -r
# Debian/Ubuntu: apply latest kernel updates
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)
# RHEL/Rocky/Alma
sudo dnf update kernel
# Reboot to activate the patched kernel
sudo systemctl reboot
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
