{"id":"CVE-2025-38352","kind":"vulnerability","aliases":["CVE-2025-38352"],"related":[],"title":"In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nposix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()\n\nIf an exiting non-autoreaping task has already passed exit_notify() and\ncalls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent\nor debugger right after unlock_task_sighand().\n\nIf a concurrent posix_cpu_timer_del() runs at that moment, it won't be\nable to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or\nlock_task_sighand() will fail.\n\nAdd the tsk->exit_state check into run_posix_cpu_timers() to fix this.\n\nThis fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because\nexit_task_work() is called before exit_notify(). But the check still\nmakes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail\nanyway in this case.","summary":"A race condition in the Linux kernel lets a local process change data between a check and its use, which can affect confidentiality, integrity and availability. CISA lists it as actively exploited in the wild.","severity":"high","cvss":7.8,"epss":null,"exploited":true,"exploited_at":"2025-09-04T00:00:00+00:00","products":[{"name":"linux kernel","fixed":["5.4.295"],"affected":">= 2.6.36, < 5.4.295","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.10.239"],"affected":">= 5.5, < 5.10.239","ecosystem":"vendor"},{"name":"linux kernel","fixed":["5.15.186"],"affected":">= 5.11, < 5.15.186","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.1.142"],"affected":">= 5.16, < 6.1.142","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.6.94"],"affected":">= 6.2, < 6.6.94","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.12.34"],"affected":">= 6.7, < 6.12.34","ecosystem":"vendor"},{"name":"linux kernel","fixed":["6.15.3"],"affected":">= 6.13, < 6.15.3","ecosystem":"vendor"},{"name":"linux kernel","fixed":[],"affected":"= 6.16","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 11.0","ecosystem":"vendor"},{"name":"Linux Kernel","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","kubernetes","linux","self-hosted"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the kernel vendor's mitigation or patch per CISA guidance; discontinue use of the product if no mitigation is available.","status":"open","published_at":"2025-07-22T08:15:23+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:44:52+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:44:52Z","model":"claude-haiku-5-5","output":{"fix":"Apply the kernel vendor's mitigation or patch per CISA guidance; discontinue use of the product if no mitigation is available.","reach":"local","summary":"A race condition in the Linux kernel lets a local process change data between a check and its use, which can affect confidentiality, integrity and availability. CISA lists it as actively exploited in the wild.","category":"infrastructure","who_cares":["linux","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Local attacker escalates privileges or corrupts kernel-managed data on the host.","analyst_note":"Find affected kernel version ranges and the upstream fix commit via the NVD or kernel.org entry for CVE-2025-38352 and the CISA KEV page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000425,"input_tokens":2549,"output_tokens":340,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2025':18A,21A '-38352':19A,22A '0':165C 'abl':160C 'activ':80B 'add':176C,220C 'affect':71B 'alreadi':119C 'and/or':170C 'anyway':225C 'autoreap':116C 'avail':75B 'call':124C,208C 'case':228C 'chang':61B 'check':65B,181C,214C 'cisa':76B 'concurr':147C 'condit':52B 'confidenti':72B 'config':196C 'cpu':13A,97C,104C,108C,127C,149C,166C,185C,198C 'cve':17A,20A 'data':62B 'debian':39A 'debugg':139C 'del':110C,151C 'detect':162C 'exit':113C,121C,179C,204C,210C 'exploit':43B,81B 'fail':175C,224C 'fix':15A,99C,188C,191C 'follow':6A,90C 'handl':102C,125C 'host':49B 'infrastructur':44B 'integr':73B 'irq':130C 'it.cpu.firing':164C 'kernel':4A,24A,26A,28A,30A,32A,34A,36A,38A,42A,56B,88C 'kubernet':45B 'let':57B 'linux':3A,23A,25A,27A,29A,31A,33A,35A,37A,40A,41A,46B,55B,87C 'list':77B 'local':59B 'lock':171C 'make':216C 'moment':155C 'need':194C 'non':115C 'non-autoreap':114C 'notifi':122C,211C 'parent':137C 'pass':120C 'posix':12A,96C,103C,107C,126C,148C,184C,197C 'posix-cpu-tim':11A,95C 'posix_cputimers_work.work':222C 'process':60B 'race':16A,51B,100C 'rcu':169C 'reap':134C 'resolv':10A,94C 'right':140C 'run':152C,183C 'self':48B 'self-host':47B 'sens':217C 'sighand':144C,173C 'state':180C 'still':215C 'task':117C,143C,168C,172C,200C,205C,218C 'timer':14A,98C,105C,109C,128C,150C,163C,167C,186C,199C 'tsk':178C,221C 'unlock':142C 'use':68B 'vulner':7A,91C 'wild':84B 'won':157C 'work':201C,206C,219C 'y':202C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-07-22T08:15:23+00:00","kev":{"dateAdded":"2025-09-04","dueDate":"2025-09-25","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-38352","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-38352","severity":null,"published_at":"2025-09-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T11:39:14+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-38352","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-38352","severity":null,"published_at":"2025-07-22T08:15:23+00:00","modified_at":"2026-09-08T18:17:32+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}