CVE-2025-38352: Linux kernel posix-cpu-timers race condition (local privilege escalation)

Exploited in the wild High 7.8 EPSS 1.4% Linux kernel

A race between handle_posix_cpu_timers() and posix_cpu_timer_del() lets a timer run against a task that is already being reaped, a time-of-check/time-of-use race that a local user can exploit with high impact on confidentiality, integrity and availability (CVSS 7.8). Kernels built with CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y do not need the fix, according to the kernel CVE record. Google's September 2025 Android bulletin reported limited, targeted exploitation; CISA added it to KEV on 4 September 2025.

• CVE-2025-38352CVE identifier
• 7.8CVSS 3.1 base score (high)
• 2025-09-04added to CISA's exploited list (US federal deadline 2025-09-25)
• 1.4%EPSS: chance of exploitation in the next 30 days (higher than 72% of CVEs)
• 2025-07-22published

What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms

Affected and fixed versions

Affected:

• Linux 2.6.36 through 5.4.294
• Linux 5.5 through 5.10.238
• Linux 5.11 through 5.15.185
• Linux 5.16 through 6.1.141
• Linux 6.2 through 6.6.93
• Linux 6.7 through 6.12.33
• Linux 6.13 through 6.15.2

Fixed in:

• Linux 5.4.295
• Linux 5.10.239
• Linux 5.15.186
• Linux 6.1.142
• Linux 6.6.94
• Linux 6.12.34
• Linux 6.15.3
• Linux 6.16

Am I affected?

uname -r
grep CONFIG_POSIX_CPU_TIMERS_TASK_WORK /boot/config-$(uname -r)   # =y means the race is not reachable

Patch it

Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.

sudo apt update
sudo apt upgrade
sudo reboot

sudo apt update
sudo apt upgrade
sudo reboot

sudo dnf upgrade kernel
sudo reboot

sudo dnf upgrade --refresh kernel

sudo zypper refresh
sudo zypper update kernel-default

sudo dnf upgrade --releasever=latest kernel kernel6.12

sudo pacman -Syu

apk update && apk upgrade linux-lts linux-virt

not Linux

General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.

Fix status in Linux distributions

From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.

If you cannot patch yet

• Red Hat lists no practical mitigation; update the kernel.

Sources

• CVE record CVE-2025-38352
• NVD CVE-2025-38352
• CISA KEV entry CVE-2025-38352
• Debian security tracker CVE-2025-38352
• Ubuntu CVE page CVE-2025-38352
• Red Hat CVE page CVE-2025-38352
• Upstream fix (stable) 2c72fe18cc5f
• Android Security Bulletin September 2025
• https://git.kernel.org/stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200
• https://git.kernel.org/stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b
• https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b
• https://git.kernel.org/stable/c/764a7a5dfda23f69919441f2eac2a83e7db6e5bb
• https://git.kernel.org/stable/c/c29d5318708e67ac13c1b6fc1007d179fb65b4d7
• https://git.kernel.org/stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b
• https://git.kernel.org/stable/c/f90fff1e152dedf52b932240ebbd670d83330eca
• CISA Known Exploited Vulnerabilities catalog

Page generated automatically from official sources on 2026-11-03 18:05 UTC and reviewed by an editor. Always confirm with your vendor's advisory.