CVE-2025-38352
Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
Description
CVE-2025-38352 is a high-severity race condition vulnerability in the Linux kernel's POSIX CPU timer subsystem, specifically in the interaction between handle_posix_cpu_timers() and posix_cpu_timer_del(). The vulnerability allows a local attacker to exploit a time-of-check-time-of-use (TOCTOU) race condition that occurs when an exiting task processes CPU timers from an interrupt context while a concurrent timer deletion is in progress. With a CVSS v3.1 base score of 7.4 and high attack complexity, successful exploitation can lead to local privilege escalation without requiring any user interaction. CISA has added CVE-2025-38352 to the Known Exploited Vulnerabilities catalog with a remediation deadline of September 25, 2025, and although the EPSS score of 0.08% at the 23rd percentile is low, the confirmed active exploitation and the availability of a public exploit make this a priority for Linux system administrators.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| linux | linux kernel | >= 2.6.36, < 5.4.295; >= 5.5, < 5.10.239; >= 5.11, < 5.15.186; >= 5.16, < 6.1.142; >= 6.2, < 6.6.94; >= 6.7, < 6.12.34; >= 6.13, < 6.15.3; 6.16 |
| debian | debian linux | 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://git.kernel.org/stable/c/2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff(Patch)
- https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b(Patch)
- https://git.kernel.org/stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b(Patch)
- https://git.kernel.org/stable/c/764a7a5dfda23f69919441f2eac2a83e7db6e5bb(Patch)
- https://git.kernel.org/stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200(Patch)
- https://git.kernel.org/stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b(Patch)
- https://git.kernel.org/stable/c/c29d5318708e67ac13c1b6fc1007d179fb65b4d7(Patch)
- https://git.kernel.org/stable/c/f90fff1e152dedf52b932240ebbd670d83330eca(Patch)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html(Mailing List, Third Party Advisory)
- https://github.com/farazsth98/chronomaly(Exploit)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-38352(US Government Resource)
Weakness Type
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CVE-2025-38352 is classified under CWE-367 (Time-of-check Time-of-use Race Condition), a weakness where the software checks the state of a resource before using it, but the resource can be modified between the check and the use, invalidating the results of the check. In the Linux kernel's POSIX CPU timer handling, a race condition between an exiting task's IRQ-triggered timer processing and a concurrent timer deletion allows the deletion to miss the firing state, leading to a use-after-free condition.
Learn more: CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition
Impact Analysis
CVE-2025-38352 carries a CVSS v3.1 base score of 7.4 (High severity) and requires local access (AV:L) with high attack complexity (AC:H), no privileges (PR:N), and no user interaction (UI:N). Confidentiality, integrity, and availability all face high impact because the TOCTOU race condition leads to memory corruption that can be exploited for local privilege escalation to root. The high attack complexity reflects the need to win the race condition between the timer processing in interrupt context and the concurrent timer deletion, which requires precise timing. However, the no-privilege requirement means any local user on the system can attempt exploitation. The vulnerability affects an extremely broad range of Linux kernel versions, from 2.6.36 through the latest 6.x releases, impacting virtually every actively maintained kernel version. Organizations running Linux servers, containers, cloud instances, and embedded systems should assess their exposure, particularly for multi-tenant environments where local privilege escalation directly threatens tenant isolation.
Exploit Maturity
CVE-2025-38352 has confirmed exploit maturity. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. A public exploit is available via the chronomaly repository on GitHub, which provides a working proof-of-concept for this POSIX CPU timer race condition. Despite the low EPSS score of 0.08% at the 23rd percentile, the combination of a public exploit and KEV catalog inclusion indicates that sophisticated attackers are successfully leveraging this vulnerability. The ransomware association is currently classified as unknown. The high attack complexity means exploitation is not trivial, but the availability of public exploit code significantly lowers the barrier for skilled attackers. Linux kernel race conditions have historically been favored by threat actors for privilege escalation in targeted attacks against cloud infrastructure and containerized environments.
Remediation
-
Update the Linux kernel to a patched version immediately. Fixed versions include: 5.4.295+, 5.10.239+, 5.15.186+, 6.1.142+, 6.6.94+, 6.12.34+, or 6.15.3+ depending on your kernel branch. The patches are available from the kernel stable git repository.
-
Prioritize patching multi-tenant and internet-facing systems where local privilege escalation poses the greatest risk. Cloud instances, container hosts, and shared servers should be patched first, as these environments are most exposed to local privilege escalation attacks.
-
Implement kernel live patching where available (e.g., Ubuntu Livepatch, RHEL kpatch, SUSE kGraft) to apply the fix without requiring a reboot, minimizing downtime for production systems.
-
Monitor for exploitation attempts by reviewing kernel logs (dmesg) for unusual POSIX timer-related errors, unexpected task crashes during exit, or signs of memory corruption. Endpoint detection tools that monitor for privilege escalation patterns can provide additional detection coverage.
-
Restrict local access where operationally feasible. Limit SSH access, enforce strong authentication, and use mandatory access control frameworks (SELinux, AppArmor) to contain the damage from potential exploitation even if the race condition is successfully triggered.
Technical Details
CVE-2025-38352 is a TOCTOU race condition (CWE-367) in the Linux kernel's POSIX CPU timer subsystem. The CVSS v3.1 vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H reflects a local attack with high complexity but full impact on all CIA dimensions. The vulnerability occurs in the interaction between handle_posix_cpu_timers() called from IRQ context and posix_cpu_timer_del() called concurrently. When an exiting non-auto-reaping task has passed exit_notify() and processes CPU timers from an interrupt handler, it releases the signal handler lock via unlock_task_sighand(). At this point, the task can be reaped by its parent or debugger. If a concurrent posix_cpu_timer_del() executes at this precise moment, it cannot detect that the timer is in the firing state (timer->it.cpu.firing != 0) because cpu_timer_task_rcu() and/or lock_task_sighand() will fail on the freed task. This results in a use-after-free condition. The fix adds an exit_state check in run_posix_cpu_timers() to prevent the race. The vulnerability affects kernels from version 2.6.36 onward, though systems with CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y are inherently protected because exit_task_work() is called before exit_notify().
Frequently Asked Questions
Is CVE-2025-38352 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-38352 to the KEV catalog. A public exploit named "chronomaly" is available on GitHub, providing a proof-of-concept for this Linux kernel race condition.
What products are affected by CVE-2025-38352?
The Linux kernel from version 2.6.36 through recent 6.x releases is affected, spanning virtually all actively maintained kernel branches. Fixed versions include 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, and 6.15.3. Debian Linux 11.0 is also listed as affected.
How do I fix CVE-2025-38352?
Update to a patched kernel version for your distribution. The fix adds an exit_state check in run_posix_cpu_timers() to prevent the race condition. Use kernel live patching where available to minimize downtime.
How severe is CVE-2025-38352?
CVE-2025-38352 has a CVSS v3.1 base score of 7.4 (High). While the attack complexity is high due to the need to win a race condition, successful exploitation leads to local privilege escalation with full confidentiality, integrity, and availability impact. The public exploit availability increases the practical risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.