In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is in the KEV database since Sept. 4, 2025.

The EPSS score is 0.0058.

Exploitation active

Automatable no

Technical Impact total

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

Configuration 1 [-]

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux
  • Linux Kernel
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4327-1 linux security update
Debian DLA Debian DLA DLA-4328-1 linux-6.1 security update
Debian DSA Debian DSA DSA-5973-1 linux security update
EUVD EUVD EUVD-2025-22297 In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Ubuntu USN Ubuntu USN USN-7769-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7769-2 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7769-3 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7770-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7771-1 Linux kernel (OEM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7774-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-7774-2 Linux kernel (FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7774-3 Linux kernel (Real-time) vulnerabilities
Ubuntu USN Ubuntu USN USN-7775-1 Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN Ubuntu USN USN-7775-2 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7776-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-7775-3 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-7774-4 Linux kernel (KVM) vulnerabilities
Ubuntu USN Ubuntu USN USN-7789-1 Linux kernel (Oracle) vulnerabilities
Ubuntu USN Ubuntu USN USN-7774-5 Linux kernel (NVIDIA Tegra IGX) vulnerabilities
Ubuntu USN Ubuntu USN USN-7789-2 Linux kernel (Raspberry Pi) vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff cve-icon cve-icon
https://git.kernel.org/stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b cve-icon cve-icon
https://git.kernel.org/stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b cve-icon cve-icon
https://git.kernel.org/stable/c/764a7a5dfda23f69919441f2eac2a83e7db6e5bb cve-icon cve-icon
https://git.kernel.org/stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200 cve-icon cve-icon
https://git.kernel.org/stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b cve-icon cve-icon
https://git.kernel.org/stable/c/c29d5318708e67ac13c1b6fc1007d179fb65b4d7 cve-icon cve-icon
https://git.kernel.org/stable/c/f90fff1e152dedf52b932240ebbd670d83330eca cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2025072229-CVE-2025-38352-f1de@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-38352 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-38352 cve-icon
History

Fri, 05 Sep 2025 14:30:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*

Thu, 04 Sep 2025 22:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 04 Sep 2025 17:30:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2025-09-04T00:00:00+00:00', 'dueDate': '2025-09-25T00:00:00+00:00'}

Tue, 02 Sep 2025 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362

Tue, 02 Sep 2025 21:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-367

Tue, 02 Sep 2025 20:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-362
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

cvssV3_1

{'score': 7.4, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Tue, 29 Jul 2025 12:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Moderate

Wed, 23 Jul 2025 20:30:00 +0000

Type Values Removed Values Added
First Time appeared Linux
Linux linux Kernel
Vendors & Products Linux
Linux linux Kernel

Tue, 22 Jul 2025 08:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Title posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2025-09-05T03:55:31.046Z

Reserved: 2025-04-16T04:51:24.006Z

Link: CVE-2025-38352

cve-icon Vulnrichment

Updated: 2025-09-02T18:20:34.530Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-22T08:15:23.577

Modified: 2025-09-05T14:18:52.123

Link: CVE-2025-38352

cve-icon Redhat

Severity : Moderate

Publid Date: 2025-07-22T00:00:00Z

Links: CVE-2025-38352 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2025-07-23T20:19:28Z