CVE-2025-38349: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-38349 is a use-after-free (UAF) vulnerability in the Linux kernel's eventpoll (epoll) subsystem, caused by decrementing the epoll (ep) reference count while still holding the ep mutex. The flaw was identified by Google Project Zero researcher Jann Horn and disclosed on July 18, 2025. It affects Linux kernel versions 6.4 through 6.6.99, 6.7 through 6.12.39, 6.13 through 6.15.7, and release candidates 6.16-rc1 through 6.16-rc5. It carries a CVSS v3.1 base score of 7.8 (High), requiring only low-privileged local access with no user interaction (Android Advisory, Feedly).

The root cause is a race condition in the epoll reference counting logic (CWE-416: Use After Free). When the epoll instance's reference count is decremented before mutex_unlock(&ep->mtx) is called, a concurrent thread holding another reference to the same ep object can drop its reference and free the structure while the first thread is still executing the mutex unlock path. This is unsafe because mutex_unlock() may access the mutex structure even after internally releasing the lock, meaning another context can acquire the mutex and free the underlying data before the first context finishes cleanup. The fix ensures the ep refcount is not decremented until after the mutex is fully released, eliminating the window for the race. The issue was reported via the Google Project Zero issue tracker (Project Zero, Android Advisory).

Successful exploitation allows a local attacker with low privileges to trigger a use-after-free condition in kernel memory, potentially leading to arbitrary code execution in kernel context, privilege escalation to root, or system crashes causing denial of service. The high confidentiality, integrity, and availability impact scores reflect the potential for full kernel compromise, which could enable lateral movement within a host, credential theft, or complete system takeover. Android devices running affected kernel versions are also impacted, as the vulnerability was included in the December 2025 Android Security Bulletin (Android Advisory, Feedly).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for CVE-2025-38349 as of the available data. The EPSS score is approximately 0.018% (0.000180), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access and the ability to trigger a specific race condition in the epoll subsystem, which adds practical complexity (Feedly, Android Advisory).

Patches have been backported to multiple stable kernel branches: upgrade to Linux kernel 6.6.99 or later (for the 6.4–6.6 branch), 6.12.39 or later (for the 6.7–6.12 branch), or 6.15.7 or later (for the 6.13–6.15 branch). Downstream distributions have issued advisories and updated packages, including Debian DSA-5975-1, Ubuntu USN-7879-1/2/3/4, Ubuntu USN-7880-1, Ubuntu USN-7934-1, Red Hat RHSA-2026:1143, RHSA-2026:1690, RHSA-2026:2759, RHSA-2026:4111, and Rocky Linux RLSA-2026:1143/1690. Android users should apply the December 2025 security patch level. No configuration-based workaround is available; patching is the only remediation (Android Advisory, Kernel Patches).

The vulnerability was credited to Google Project Zero researcher Jann Horn, who identified the subtle race condition in epoll reference counting. The issue was tracked in the Project Zero issue tracker prior to public disclosure. Downstream Linux distributions including Debian, Ubuntu, Red Hat, Oracle Linux, Rocky Linux, and AlmaLinux have all issued security advisories and updated kernel packages. The December 2025 Android Security Bulletin also addressed this vulnerability, prompting coverage from Samsung patch notes and security news outlets (Project Zero, Android Advisory).