Executive brief
A vulnerability in the Linux kernel's event notification system (epoll) could allow a local user to crash the system. By creating complex, deeply nested structures of event monitors, an attacker can trigger excessive recursion that exhausts system resources. This results in a denial-of-service condition, impacting the availability of the affected device or server.
Technical details
An uncontrolled recursion vulnerability exists in the Linux kernel's eventpoll (epoll) implementation due to insufficient depth checks in ep_loop_check_proc(). While the kernel attempts to limit the nesting of epoll instances to EP_MAX_NESTS, the existing logic fails to account for upward paths in the graph and only considers a single path when multiple downward paths exist. A local attacker can exploit this by constructing a complex graph of epoll file descriptors that exceeds the intended recursion limits (tested up to a depth of ~500), potentially leading to a kernel stack overflow or denial of service. The fix introduces more robust tracking of subtree depths and upward traversal checks to strictly enforce nesting limits.
Affected products
- Linux Linux Kernel v6.15 and earlier versions
- Siemens SIMATIC CN 4100 < V5.0
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
Timeline
- 2025-07-11: patched: Initial patch submitted by Jann Horn
- 2025-08-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1b13b033062824495554e836a1ff5f85ccf6b039
- https://git.kernel.org/stable/c/2a0c0c974bea9619c6f41794775ae4b97530e0e6
- https://git.kernel.org/stable/c/3542c90797bc3ab83ebab54b737d751cf3682036
- https://git.kernel.org/stable/c/71379495ab70eaba19224bd71b5b9b399eb85e04
- https://git.kernel.org/stable/c/7a2125962c42d5336ca0495a9ce4cb38a63e9161
- https://git.kernel.org/stable/c/ea5f97dbdcb1651581a22bd10afd2f0dd9dc11d6
- https://git.kernel.org/stable/c/f2e467a48287c868818085aa35389a224d226732