ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2025-38687

In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, whic

Published Sep 4, 2025 · catalog updated Oct 19, 2026 · Linux Linux

Check this week

CVE-2025-38687 is not in CISA KEV. FIRST estimates a 13.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
13.00%
Remediation
Advisory link
Affected products
cpe debian/debian linux · cpe linux/linux kernel · vendor Linux Linux 3.14

In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or removed, as the memory for the wait_queue_head has been freed. We need to check there are no tasks queued on any of the subdevices' wait queues before allowing the device to be detached by the ioctl. Tasks will read-lock before adding themselves to the subdevice wait queue, so fix the problem in the ioctl handler by write-locking before checking that all of the subdevices are safe to be deleted. This includes testing for any sleepers on the subdevices' wait queues. It remains locked until the device has been detached. This requires the function to be refactored slightly, moving the bulk of it into new function . Note that the refactor of results in now being called while is write-locked, which wasn't the case previously, but that does not matter. Thanks to Jens Axboe for diagnosing the problem and co-developing this patch.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe debian/debian linux11.0
  • cpe linux/linux kernelversion unspecified
  • vendor Linux Linux 3.143.14

How to fix CVE-2025-38687

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2025-38687 is not in CISA KEV. FIRST estimates a 13.00% chance of exploitation in the next 30 days. Check whether you run Linux Linux.

Which versions are affected?

Compare what you have installed with debian/debian linux 11.0; Linux Linux 3.14 3.14. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-362: Race Condition. EPSS 13.00%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Sep 4, 2025 · NIST NVD

    Detected

    In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or rem

  2. Oct 19, 2026 · NIST NVD

    Updated

    In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still active on the wait_queue_head inside of it. This can cause a use-after-free when the poll entries are later triggered or rem

Sources

  • CVE.orgVulnerability recordCVE-2025-38687

    Official CVE identifier

    cve.org
  • EUVDVulnerability recordEUVD-2025-26782

    In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still acti

    euvd.enisa.europa.eu
  • NIST NVDVulnerability recordCVE-2025-38687

    In the Linux kernel, the following vulnerability has been resolved: comedi: fix race between polling and detaching syzbot reports a use-after-free in comedi in the below link, which is due to comedi gladly removing the allocated async area even though poll requests are still ac

    nvd.nist.gov

References

Freshness

Last verified in this catalog Oct 19, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.