Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U N N H 5.5 .0019 9.3 —
AFFECTED
Product Versions Fixed
Linux 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 – —
Linux 6.13 – 6.14.8
TIMELINE
Apr 16 Reserved by Linux
Jun 6 Published (CNA: Linux)
Jul 30 EXPLOIT PUBLISHED — CVE-2025-38002 (Linux). Public exploit reference added.
Jul 30 RESCORED — CVE-2025-38002 (Linux). CVSS 7.8 → 5.5 (NVD).
Description
In the Linux kernel, the following vulnerability has been resolved:
io_uring/fdinfo: grab ctx->uring_lock around io_uring_show_fdinfo()
Not everything requires locking in there, which is why the 'has_lock'
variable exists. But enough does that it's a bit unwieldy to manage.
Wrap the whole thing in a ->uring_lock trylock, and just return
with no output if we fail to grab it. The existing trylock() will
already have greatly diminished utility/output for the failure case.
This fixes an issue with reading the SQE fields, if the ring is being
actively resized at the same time.
Lifecycle
Complete event history — 4 events, chronological
| Date | Event | Detail |
|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| June 6, 2025 | Published | Published (CNA: Linux) |
| July 30, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2025-38002 (Linux). Public exploit reference added. |
| July 30, 2026 | RESCORED | RESCORED — CVE-2025-38002 (Linux). CVSS 7.8 → 5.5 (NVD). |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 79cfe9e59c2a12c3b3faeeefe38d23f3d8030972 | — |
| Linux | Linux | — | 6.13 | 6.14.8 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-38002 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.