Critical Use-After-Free Vulnerability in Linux Kernel: Eventpoll Reference Count Issue
Summary
DEBIAN-CVE-2025-38349: In the Linux kernel, the following vulnerability has been resolved: eventpoll: don't decrement ep refcount while still holding the ep mutex Jann Horn points out that epoll is decrementing the ep refcount and then doing a... Affects linux versions < 6.12.41-1. Fixed in 6.12.41-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, responsible for managing hardware resources and providing essential services to software applications. It is known for its stability, performance, and security features. However, like any complex software, it is susceptible to vulnerabilities that can compromise system integrity. This specific vulnerability affects the eventpoll mechanism, which is used for monitoring multiple file descriptors to see if they are ready for I/O operations.
Vulnerability Detail
In the Linux kernel, a critical vulnerability has been identified in the eventpoll implementation. The issue arises from the incorrect handling of reference counts while holding a mutex. Specifically, the epoll mechanism decrements the reference count of an eventpoll structure before releasing the associated mutex. This can lead to a use-after-free condition, where another thread may free the eventpoll structure while it is still being accessed, potentially resulting in undefined behavior or system crashes. The vulnerability highlights the importance of proper synchronization and reference counting in concurrent programming.
How To Fix
Minimum fixed version
6.12.41-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to apply the available patches as soon as possible.
Conclusion
The identified vulnerability in the Linux kernel's eventpoll mechanism poses significant risks due to improper reference counting. Users are strongly advised to update their systems to the patched versions to ensure security and stability. Regular monitoring for vulnerabilities using tools like Vulert can help maintain system integrity.
See every vulnerability recorded for linux →
FAQ
The vulnerability is a use-after-free condition in the eventpoll mechanism of the Linux kernel, caused by improper reference count management while holding a mutex.
The vulnerability affects Debian 13 and Debian 14 systems running specific versions of the Linux kernel.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring installation.
Exploiting this vulnerability could lead to system crashes, undefined behavior, or potential security breaches due to unauthorized access to system resources.
While no specific workarounds are available, it is recommended to minimize exposure by limiting access to affected systems and applying patches promptly.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
