CVE-2025-38614

What it actually does

The flaw permits epoll file descriptor graphs to exceed EP_MAX_NESTS nesting depth, allowing recursion of at least ~500 levels during loop checks and path traversals because upward depth and multi-path subtree calculations were incomplete.

Why it matters to the business

Local users or container workloads can trigger kernel stack exhaustion leading to system crashes or hangs, disrupting availability on Linux hosts especially in container-optimized environments with high epoll usage.

How an attack unfolds

An attacker with local access constructs a deep epoll nesting tree by linking multiple epoll instances. Kernel operations such as ep_loop_check_proc or reverse_path_check then perform excessive recursion; threat actors associated with VMSCAPE and related Linux kernel privilege-escalation campaigns on Container-Optimized OS may chain this into broader attacks.

How to fix it

Upgrade the Linux kernel to a version containing commit 71379495ab70eaba19224bd71b5b9b399eb85e04. For Chainguard packages upgrade openjdk-17-openj9* to 0.53.0-r0 or later. Reboot affected systems after kernel updates.

How to confirm the fix worked

Confirm the running kernel contains the referenced commit; attempt to create epoll nests exceeding EP_MAX_NESTS and verify the kernel now enforces the depth limit without crashing.

Typical attack path

1. Obtain local user or container access on an affected Linux kernel
2. Allocate multiple epoll file descriptors
3. Create nested links forming a graph deeper than EP_MAX_NESTS
4. Trigger epoll operations that invoke depth-checking or traversal routines
5. Induce unbounded recursion causing stack overflow and denial of service

How to detect it

Review kernel logs and audit trails for repeated eventpoll recursion warnings or stack traces; correlate with process activity creating large numbers of epoll file descriptors; inspect container runtime logs for suspicious epoll-heavy workloads from actors such as VMSCAPE.

What your security team should do

• Apply kernel and Chainguard package updates immediately given the 434-day publication window and container-focused threat actor interest
• Restrict unprivileged local access and container capabilities that permit epoll manipulation
• Monitor kernel logs for eventpoll recursion warnings and schedule staged rollouts