CVE-2025-38352: Linux kernel POSIX CPU timer TOCTOU race enables local privilege escalation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCISA KEV listing plus a public exploit reference and high CVSS impact make this a high-priority local privilege escalation risk despite the low EPSS probability.

What it is

A time-of-check to time-of-use race exists in the Linux kernel between handle_posix_cpu_timers() and posix_cpu_timer_del(). When an exiting non-autoreaping task has passed exit_notify() and runs handle_posix_cpu_timers() from IRQ, a concurrent posix_cpu_timer_del() can fail to observe timer->it.cpu.firing != 0 because cpu_timer_task_rcu() or lock_task_sighand() fails, leading to use-after-free style corruption. The fix adds a tsk->exit_state check in run_posix_cpu_timers().

Impact

A local attacker can corrupt kernel state and potentially gain code execution or cause a denial of service with high confidentiality, integrity and availability impact.

Attack surface

Reached locally through POSIX CPU timer operations on a task that is exiting; the CVSS vector is AV:L/AC:L/PR:L/UI:N, so low-privileged local access is required and no user interaction is needed.

Exploitation

CVE-2025-38352 is listed in CISA KEV with a due date of 2025-09-25, and a public exploit reference (chronomaly) is present, indicating active exploitation. EPSS 30-day probability is 0.01254 (67.98th percentile), so mass scanning is unlikely but targeted use is plausible.

What to do

• Apply the upstream Linux kernel patches referenced in the git.kernel.org stable commits and update to a fixed kernel version.
• For Debian, apply the fixes announced in the debian-lts-announce mailing list advisories.
• If patching is not immediately possible, restrict local shell and process access to trusted users and monitor for suspicious POSIX timer activity.
• Follow CISA BOD 22-01 guidance for cloud services and discontinue use of affected kernels where mitigations are unavailable.

Detection

• Monitor for kernel crashes or oopses referencing posix_cpu_timer_del, handle_posix_cpu_timers, or run_posix_cpu_timers.
• Audit local processes that create and delete POSIX CPU timers on exiting tasks, especially non-autoreaping children.
• Track CISA KEV status and correlate with host telemetry for known exploit artifacts such as the chronomaly project.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.