{"id":"ASB-A-432751421","details":"In multiple functions of eventpoll.c, there is a possible use after free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","aliases":["A-432751421","CVE-2025-38349"],"modified":"2026-09-18T15:47:37.392928379Z","published":"2025-12-01T00:00:00Z","references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-12-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d"}],"affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-12-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d"],"severity":"High","spl":"2025-12-05","types":["EoP"],"vanir_signatures":[{"target":{"function":"__ep_remove","file":"fs/eventpoll.c"},"deprecated":false,"digest":{"function_hash":"225272087380341930722764372070177932387","length":980},"id":"ASB-A-432751421-07f881bd","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4"},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"eventpoll_release_file"},"deprecated":false,"digest":{"function_hash":"193742352529799999018054022901653944807","length":476},"id":"ASB-A-432751421-09c27d3c","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"302585684081311364259973594735594056069","length":109},"id":"ASB-A-432751421-1187aa3f","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"ep_remove_safe"}},{"signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"ep_remove_safe"},"deprecated":false,"digest":{"length":109,"function_hash":"302585684081311364259973594735594056069"},"id":"ASB-A-432751421-15d3c249","signature_type":"Function"},{"signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["191086137022076412654719601900755324637","305880740741489180353900614106308834343","156354163012597448717876851313346644374","43133606676216229872366682582595430577","53680982208576432672483418914650228635","143084532597701593378095613599655973036","245259190946504012864677613054117331229","185163040645222305081070194719032503973","275426261501251460314004956379080083057","22230450026473659538222166346120204230","198239684236587095227658438206885406496","264886695460970654656505020233803929826","156246689978767029069455274798735238302","96310133543355706759918774982179183095","71581205124471488349769021492195145642","124668659825270235954482475400933640404","338749947511906827518898661969395561128","338800242697408465896954949919072303267","52851446014308305584998005002837404056","188669672070099765290301194341975930854","219856154056342786804513759120734090660","153684431549941401248837892446231039374","52003684389434483397801170239171013421","79341163529413239514464459628078193806"]},"id":"ASB-A-432751421-37bd2f54"},{"source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c"},"deprecated":false,"digest":{"line_hashes":["99707066724420952802937730033197315754","76782040879425346743140689371658564088","156354163012597448717876851313346644374","43133606676216229872366682582595430577","53680982208576432672483418914650228635","143084532597701593378095613599655973036","245259190946504012864677613054117331229","185163040645222305081070194719032503973","275426261501251460314004956379080083057","22230450026473659538222166346120204230","198239684236587095227658438206885406496","264886695460970654656505020233803929826","156246689978767029069455274798735238302","96310133543355706759918774982179183095","71581205124471488349769021492195145642","124668659825270235954482475400933640404","338749947511906827518898661969395561128","338800242697408465896954949919072303267","52851446014308305584998005002837404056","321089779111838009070075004849469478841","219856154056342786804513759120734090660","153684431549941401248837892446231039374","52003684389434483397801170239171013421","79341163529413239514464459628078193806"],"threshold":0.9},"id":"ASB-A-432751421-38377723","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"57695190440068655440460860376309819076","length":611},"id":"ASB-A-432751421-987c1f0b","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"ep_clear_and_put"}},{"digest":{"function_hash":"50291707803570425513963959457156653771","length":962},"id":"ASB-A-432751421-aee69f0d","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"file":"fs/eventpoll.c","function":"__ep_remove"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/da1160c4a8687538ed5ae4fab9a49b150a04a9e4","target":{"file":"fs/eventpoll.c","function":"ep_clear_and_put"},"deprecated":false,"digest":{"length":611,"function_hash":"57695190440068655440460860376309819076"},"id":"ASB-A-432751421-be9b8a64"},{"id":"ASB-A-432751421-e8422835","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/d12def49bbdb0887ccda3729104ae113966a5b2d","target":{"function":"eventpoll_release_file","file":"fs/eventpoll.c"},"deprecated":false,"digest":{"length":476,"function_hash":"193742352529799999018054022901653944807"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-432751421.json"}}],"schema_version":"1.9.0"}