{"schema_version":"1.7.5","id":"ASB-A-432751421","published":"2025-12-01T00:00:00Z","modified":"2026-07-24T16:43:26.002557455Z","aliases":["A-432751421","CVE-2025-38349"],"details":"In multiple functions of eventpoll.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-12-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d"],"severity":"High","spl":"2025-12-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"225272087380341930722764372070177932387","length":980},"id":"ASB-A-432751421-07f881bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"__ep_remove"}},{"deprecated":false,"digest":{"function_hash":"193742352529799999018054022901653944807","length":476},"id":"ASB-A-432751421-09c27d3c","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"eventpoll_release_file"}},{"deprecated":false,"digest":{"function_hash":"302585684081311364259973594735594056069","length":109},"id":"ASB-A-432751421-1187aa3f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"ep_remove_safe"}},{"deprecated":false,"digest":{"function_hash":"302585684081311364259973594735594056069","length":109},"id":"ASB-A-432751421-15d3c249","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"ep_remove_safe"}},{"deprecated":false,"digest":{"line_hashes":["191086137022076412654719601900755324637","305880740741489180353900614106308834343","156354163012597448717876851313346644374","43133606676216229872366682582595430577","53680982208576432672483418914650228635","143084532597701593378095613599655973036","245259190946504012864677613054117331229","185163040645222305081070194719032503973","275426261501251460314004956379080083057","22230450026473659538222166346120204230","198239684236587095227658438206885406496","264886695460970654656505020233803929826","156246689978767029069455274798735238302","96310133543355706759918774982179183095","71581205124471488349769021492195145642","124668659825270235954482475400933640404","338749947511906827518898661969395561128","338800242697408465896954949919072303267","52851446014308305584998005002837404056","188669672070099765290301194341975930854","219856154056342786804513759120734090660","153684431549941401248837892446231039374","52003684389434483397801170239171013421","79341163529413239514464459628078193806"],"threshold":0.9},"id":"ASB-A-432751421-37bd2f54","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c"}},{"deprecated":false,"digest":{"line_hashes":["99707066724420952802937730033197315754","76782040879425346743140689371658564088","156354163012597448717876851313346644374","43133606676216229872366682582595430577","53680982208576432672483418914650228635","143084532597701593378095613599655973036","245259190946504012864677613054117331229","185163040645222305081070194719032503973","275426261501251460314004956379080083057","22230450026473659538222166346120204230","198239684236587095227658438206885406496","264886695460970654656505020233803929826","156246689978767029069455274798735238302","96310133543355706759918774982179183095","71581205124471488349769021492195145642","124668659825270235954482475400933640404","338749947511906827518898661969395561128","338800242697408465896954949919072303267","52851446014308305584998005002837404056","321089779111838009070075004849469478841","219856154056342786804513759120734090660","153684431549941401248837892446231039374","52003684389434483397801170239171013421","79341163529413239514464459628078193806"],"threshold":0.9},"id":"ASB-A-432751421-38377723","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c"}},{"deprecated":false,"digest":{"function_hash":"57695190440068655440460860376309819076","length":611},"id":"ASB-A-432751421-987c1f0b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"ep_clear_and_put"}},{"deprecated":false,"digest":{"function_hash":"50291707803570425513963959457156653771","length":962},"id":"ASB-A-432751421-aee69f0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"__ep_remove"}},{"deprecated":false,"digest":{"function_hash":"57695190440068655440460860376309819076","length":611},"id":"ASB-A-432751421-be9b8a64","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"ep_clear_and_put"}},{"deprecated":false,"digest":{"function_hash":"193742352529799999018054022901653944807","length":476},"id":"ASB-A-432751421-e8422835","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"eventpoll_release_file"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-432751421.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d"}]}