⚠ Actively exploited
Added to CISA KEV on 2025-09-04. Federal agencies required to patch by 2025-09-25. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-38352 — Time-of-check Time-of-use (TOCTOU) Race Condition in Linux
CWE-367 — Time-of-check Time-of-use (TOCTOU) Race ConditionCWE-362 — Race Condition94 documents14 sources
Severity
7.4HIGHNVD
OSV7.8OSV7.1OSV5.5
EPSS
0.1%
top 71.94%
CISA KEV
KEV
Added 2025-09-04
Due 2025-09-25
Exploit
No known exploits
Affected products
Timeline
PublishedJul 22
KEV addedSep 4
KEV dueSep 25
Latest updateMar 5
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().
If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task…
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HExploitability: 1.4 | Impact: 5.9
Affected Packages4 packages
▶CVEListV5linux/linux0bdd2ed4138ec04e09b4f8165981efc99e439f55 — 78a4b8e3795b31dae58762bc091bb0f4f74a2200+8
Also affects: Debian Linux 11.0