GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2025-38017 (GCVE-0-2025-38017)

Vulnerability from cvelistv5 – Published: 2025-06-18 09:28 – Updated: 2026-05-11 21:19
VLAI
Title
fs/eventpoll: fix endless busy loop after timeout has expired
Summary
In the Linux kernel, the following vulnerability has been resolved: fs/eventpoll: fix endless busy loop after timeout has expired After commit 0a65bc27bd64 ("eventpoll: Set epoll timeout if it's in the future"), the following program would immediately enter a busy loop in the kernel: ``` int main() { int e = epoll_create1(0); struct epoll_event event = {.events = EPOLLIN}; epoll_ctl(e, EPOLL_CTL_ADD, 0, &event); const struct timespec timeout = {.tv_nsec = 1}; epoll_pwait2(e, &event, 1, &timeout, 0); } ``` This happens because the given (non-zero) timeout of 1 nanosecond usually expires before ep_poll() is entered and then ep_schedule_timeout() returns false, but `timed_out` is never set because the code line that sets it is skipped. This quickly turns into a soft lockup, RCU stalls and deadlocks, inflicting severe headaches to the whole system. When the timeout has expired, we don't need to schedule a hrtimer, but we should set the `timed_out` variable. Therefore, I suggest moving the ep_schedule_timeout() check into the `timed_out` expression instead of skipping it. brauner: Note that there was an earlier fix by Joe Damato in response to my bug report in [1].
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 99a0ad16dfd114a429df665065dcc576dad743c0 , < 7631dca012593c95d36199082546a24a0058fc50 (git)
Affected: 0a65bc27bd645894175c059397b4916e31955fb2 , < d9ec73301099ec5975505e1c3effbe768bab9490 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14.4 , < 6.14.8 (semver)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/eventpoll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7631dca012593c95d36199082546a24a0058fc50",
              "status": "affected",
              "version": "99a0ad16dfd114a429df665065dcc576dad743c0",
              "versionType": "git"
            },
            {
              "lessThan": "d9ec73301099ec5975505e1c3effbe768bab9490",
              "status": "affected",
              "version": "0a65bc27bd645894175c059397b4916e31955fb2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/eventpoll.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6.14.8",
              "status": "affected",
              "version": "6.14.4",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.14.8",
                  "versionStartIncluding": "6.14.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/eventpoll: fix endless busy loop after timeout has expired\n\nAfter commit 0a65bc27bd64 (\"eventpoll: Set epoll timeout if it\u0027s in\nthe future\"), the following program would immediately enter a busy\nloop in the kernel:\n\n```\nint main() {\n  int e = epoll_create1(0);\n  struct epoll_event event = {.events = EPOLLIN};\n  epoll_ctl(e, EPOLL_CTL_ADD, 0, \u0026event);\n  const struct timespec timeout = {.tv_nsec = 1};\n  epoll_pwait2(e, \u0026event, 1, \u0026timeout, 0);\n}\n```\n\nThis happens because the given (non-zero) timeout of 1 nanosecond\nusually expires before ep_poll() is entered and then\nep_schedule_timeout() returns false, but `timed_out` is never set\nbecause the code line that sets it is skipped.  This quickly turns\ninto a soft lockup, RCU stalls and deadlocks, inflicting severe\nheadaches to the whole system.\n\nWhen the timeout has expired, we don\u0027t need to schedule a hrtimer, but\nwe should set the `timed_out` variable.  Therefore, I suggest moving\nthe ep_schedule_timeout() check into the `timed_out` expression\ninstead of skipping it.\n\nbrauner: Note that there was an earlier fix by Joe Damato in response to\nmy bug report in [1]."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-11T21:19:42.321Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7631dca012593c95d36199082546a24a0058fc50"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9ec73301099ec5975505e1c3effbe768bab9490"
        }
      ],
      "title": "fs/eventpoll: fix endless busy loop after timeout has expired",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2025-38017",
    "datePublished": "2025-06-18T09:28:25.790Z",
    "dateReserved": "2025-04-16T04:51:23.977Z",
    "dateUpdated": "2026-05-11T21:19:42.321Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-38017",
      "date": "2026-09-16",
      "epss": "0.00148",
      "percentile": "0.04408"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-38017\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-06-18T10:15:33.310\",\"lastModified\":\"2026-06-17T09:15:53.390\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nfs/eventpoll: fix endless busy loop after timeout has expired\\n\\nAfter commit 0a65bc27bd64 (\\\"eventpoll: Set epoll timeout if it\u0027s in\\nthe future\\\"), the following program would immediately enter a busy\\nloop in the kernel:\\n\\n```\\nint main() {\\n  int e = epoll_create1(0);\\n  struct epoll_event event = {.events = EPOLLIN};\\n  epoll_ctl(e, EPOLL_CTL_ADD, 0, \u0026event);\\n  const struct timespec timeout = {.tv_nsec = 1};\\n  epoll_pwait2(e, \u0026event, 1, \u0026timeout, 0);\\n}\\n```\\n\\nThis happens because the given (non-zero) timeout of 1 nanosecond\\nusually expires before ep_poll() is entered and then\\nep_schedule_timeout() returns false, but `timed_out` is never set\\nbecause the code line that sets it is skipped.  This quickly turns\\ninto a soft lockup, RCU stalls and deadlocks, inflicting severe\\nheadaches to the whole system.\\n\\nWhen the timeout has expired, we don\u0027t need to schedule a hrtimer, but\\nwe should set the `timed_out` variable.  Therefore, I suggest moving\\nthe ep_schedule_timeout() check into the `timed_out` expression\\ninstead of skipping it.\\n\\nbrauner: Note that there was an earlier fix by Joe Damato in response to\\nmy bug report in [1].\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: fs/eventpoll: corrige un bucle ocupado sin fin despu\u00e9s de que expira el tiempo de espera Despu\u00e9s de el commit 0a65bc27bd64 (\\\"eventpoll: establece el tiempo de espera de epoll si es en el futuro\\\"), el siguiente programa ingresar\u00eda inmediatamente en un bucle ocupado en el kernel: ``` int main() { int e = epoll_create1(0); struct epoll_event event = {.events = EPOLLIN}; epoll_ctl(e, EPOLL_CTL_ADD, 0, \u0026amp;event); const struct timespec timeout = {.tv_nsec = 1}; epoll_pwait2(e, \u0026amp;event, 1, \u0026amp;timeout, 0); } ``` Esto sucede porque el tiempo de espera dado (distinto de cero) de 1 nanosegundo generalmente expira antes de que se ingrese ep_poll() y luego ep_schedule_timeout() devuelve falso, pero `timed_out` nunca se establece porque se omite la l\u00ednea de c\u00f3digo que lo establece. Esto r\u00e1pidamente se convierte en un bloqueo suave, RCU se bloquea y se bloquea, lo que inflige graves dolores de cabeza a todo el sistema. Cuando el tiempo de espera ha expirado, no necesitamos programar un hrtimer, pero debemos establecer la variable `timed_out`. Por lo tanto, sugiero mover la comprobaci\u00f3n de ep_schedule_timeout() a la expresi\u00f3n `timed_out` en lugar de omitirla. brauner: Tenga en cuenta que hubo una correcci\u00f3n anterior por Joe Damato en respuesta a mi informe de error en [1].\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/eventpoll.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"99a0ad16dfd114a429df665065dcc576dad743c0\",\"lessThan\":\"7631dca012593c95d36199082546a24a0058fc50\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"0a65bc27bd645894175c059397b4916e31955fb2\",\"lessThan\":\"d9ec73301099ec5975505e1c3effbe768bab9490\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/eventpoll.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14.4\",\"lessThan\":\"6.14.8\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.14.4\",\"versionEndExcluding\":\"6.14.8\",\"matchCriteriaId\":\"73E279AE-4280-48EB-9798-AD37FE6F3D9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"13FC0DDE-E513-465E-9E81-515702D49B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8C7B5B0E-4EEB-48F5-B4CF-0935A7633845\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D240580-3048-49B2-9E27-F115A9DF8224\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.15:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"90320558-E553-4EF5-8A0B-0F5D20113BD2\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7631dca012593c95d36199082546a24a0058fc50\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d9ec73301099ec5975505e1c3effbe768bab9490\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-08T12:23:48+00:00",
      "cve": "CVE-2025-38017",
      "id": "CVE-2025-38017",
      "initial_release_date": "2025-06-18T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel: Denial of Service via endless busy loop in eventpoll",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-38017.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.