Loading vulnerability…
CVE-2025-38349 is a use-after-free vulnerability in the Linux kernel eventpoll (epoll) subsystem. An epoll object's reference count is decremented before mutex_unlock() completes. In the next-to-last-reference case, another context can acquire the internally released mutex, drop the final reference, and free the object while the original unlock operation still accesses the embedded mutex. Mutual exclusion does not prevent this lifetime race because mutex unlocking is not atomic. The vulnerability can cause access to freed kernel memory, potentially resulting in memory corruption, a kernel crash, or local privilege escalation.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A use-after-free vulnerability in the Linux kernel eventpoll subsystem. Affected Rocky Linux 10.1 kernel packages have security updates under CIQ advisory crlsa-2026_1690.
A vulnerability affecting Google COS kernel packages sys-kernel/csql-kernel-6_12 and sys-kernel/csql-kernel-6_6. The plugin identifies affected installed packages but provides no technical description or impact details. Tenable labels the plugin High severity, while the vendor rates the vulnerability LOW.
A vulnerability affecting Google COS kernel packages, identified by Tenable Cloud Security plugin 472308. The content does not describe its technical cause or impact. The plugin severity is High, while the vendor severity is Low and the VPR score is 4.9.
A use-after-free vulnerability in the Linux kernel eventpoll subsystem.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.