CVE-2025-38349

A flaw was found in the Linux kernel's eventpoll (epoll) mechanism. A local attacker could exploit a use-after-free vulnerability due to incorrect handling of the 'ep' refcount while the 'ep' mutex is still held. This can lead to memory corruption, potentially allowing the attacker to achieve privilege escalation or execute arbitrary code on the system.

This vulnerability is rated as Moderate severity because exploitation requires authenticated local access and winning a tight timing race condition between concurrent cleanup threads, precluding direct remote attacks. Although the epoll facility is built directly into the kernel and available to all unprivileged processes across standard Red Hat Enterprise Linux deployments, triggering the underlying memory corruption requires specific concurrent reference-dropping operations. Consequently, while local privilege escalation or system crashes are theoretically possible, the high attack complexity constrains the overall risk.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.