Linux · Kernel
CVE-2025-38352
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
What it is
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().
If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.
Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.
This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.
CISA: Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
What to do
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: September 25, 2025
- Added to the CISA list
- September 4, 2025
- Published
- July 22, 2025
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 1.4% in the top 28.5% of all known vulnerabilities
- Weakness
- CWE-367
- More details
- NVD · CVE.org · CISA
All references (8)
- https://git.kernel.org/stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200
- https://git.kernel.org/stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b
- https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b
- https://git.kernel.org/stable/c/764a7a5dfda23f69919441f2eac2a83e7db6e5bb
- https://git.kernel.org/stable/c/2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff
- https://git.kernel.org/stable/c/c29d5318708e67ac13c1b6fc1007d179fb65b4d7
- https://git.kernel.org/stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b
- https://git.kernel.org/stable/c/f90fff1e152dedf52b932240ebbd670d83330eca
More exploited flaws from Linux
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Sep 18, 2026 | Improper Check for Unusual or Exceptional Conditions | Kernel | Critical 9.8 | 3.3% |
| Sep 18, 2026 | Race Condition | Kernel | High 7.8 | 1.6% |
| Sep 18, 2026 | Out-of-Bounds Write | Kernel | High 8.8 | 0.9% |
| Aug 27, 2026 | Unspecified | Kernel | High 7.8 | 0.7% |
| Aug 26, 2026 | Out-of-Bounds Write | Kernel | High 7.8 | 8.9% |
| Jun 2, 2026 | Improper Authentication | Kernel | High 7.8 | 5.5% |
| May 1, 2026 | Incorrect Resource Transfer Between Spheres | Kernel | High 7.8 | 98% |
| Jan 26, 2026 | Integer Overflow | Kernel | High 7.8 | 15% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.