CVERadar
HIGH · CVSS 3.1 7.8CISA KEV · added 2025-09-04Public PoCEPSS 1.36% (p71)Threat level 54

CVE-2025-38352: Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux · Kernel · NVD published 2025-07-22 · posted 2025-09-04 · last modified 2026-09-08

What it is

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

WeaknessCWE-367
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)
CISA due date2025-09-25 (for US federal agencies under BOD; a good deadline for everyone)
ATT&CK tacticsn/a

Exploitation evidence

First exploit evidence seen: 2025-09-04 (earliest date across the sources below).

Exploited in the wild

  • CISA KEV: listed since 2025-09-04. Source

Public exploit code

GitHub proof-of-concept repositories

6 public repositories from 5 accounts, first seen 2025-12-21. Most starred: farazsth98/chronomaly (312 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · nomi-sec/PoC-in-GitHub.

No ATT&CK techniques could be mapped or inferred for this CVE yet.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

  • linux linux kernel: upgrade to 5.4.295 or later (affected from 2.6.36)
  • linux linux kernel: upgrade to 5.10.239 or later (affected from 5.5)
  • linux linux kernel: upgrade to 5.15.186 or later (affected from 5.11)
  • linux linux kernel: upgrade to 6.1.142 or later (affected from 5.16)
  • linux linux kernel: upgrade to 6.6.94 or later (affected from 6.2)
  • linux linux kernel: upgrade to 6.12.34 or later (affected from 6.7)
  • linux linux kernel: upgrade to 6.15.3 or later (affected from 6.13)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

Detection Generic guidance

    Response checklist Generic guidance

    1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
    2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
    3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
    4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

    Sources