Description
uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libuev | 2.4.1-1 | — |
| Debian 13 | libuev | 2.4.1-1 | — |
| Debian 12 | libuev | 2.4.0-1.1+deb12u1 | — |
| Debian 11 | libuev | 2.3.1-1+deb11u1 | DLA-4454-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | libuev | No fix yet | — |
| Ubuntu 26.04 LTS | libuev | No fix yet | — |
| Ubuntu 25.10 | libuev | No fix yet | — |
| Ubuntu 24.04 LTS | libuev | No fix yet | — |
| Ubuntu 22.04 LTS | libuev | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE Package Hub 15 SP5 | libuev | 2.4.1-bp155.3.3.1 | openSUSE-SU-2024:0023-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | libuev | 2.4.1-bp155.3.3.1 | openSUSE-SU-2024:0023-1 |
Advisories 2
- openSUSE-SU-2024:0023-1 Security update for libuev SUSE / openSUSE Security Updates · Feb 4, 2026
- DLA-4454-1 libuev - security update Debian Security (DSA / DLA) · Jan 25, 2026
References
- https://github.com/troglobit/libuev/issues/27
- https://github.com/troglobit/libuev/compare/v2.4.0...v2.4.1
- https://github.com/troglobit/libuev/commit/2d9f1c9ce655cc38511aeeb6e95ac30914f7aec9
- FEDORA-2024-75e1256954 vendor-advisory
- FEDORA-2024-d6a850992f vendor-advisory
- FEDORA-2024-40fbf3ee48 vendor-advisory