Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2025-38352 is a high-severity Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Path Interception (T1034); ranked in the top 33% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-25 (Reference Monitor) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is a race condition (CWE-367) in the Linux kernel's POSIX CPU timers implementation between handle_posix_cpu_timers() and posix_cpu_timer_del(). An exiting non-autoreaping task that has passed exit_notify() can invoke handle_posix_cpu_timers() from IRQ context; after unlock_task_sighand(), the task may be reaped by its parent or debugger, causing cpu_timer_task_rcu() or lock_task_sighand() to fail in a concurrent posix_cpu_timer_del() and leaving timer->it.cpu.firing undetected.
An unprivileged local attacker can trigger the race by arranging for timer deletion during the narrow window after exit_notify() but before full task reaping. Successful exploitation can corrupt timer state and yield high impact on confidentiality, integrity, and availability on affected kernels.
The referenced stable commits add an explicit tsk->exit_state check inside run_posix_cpu_timers() to close the window. The check is unnecessary when CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y because exit_task_work() runs before exit_notify(), but the guard remains useful in other configurations.
EPSS remains low at 0.0014 with no reported rise or in-the-wild exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-22297
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger…
more
right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
- CWE(s)
- KEV Date Added
- 04 September 2025
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V15.4.2V17.2.6
Mitigating Controls (NIST 800-53 r5) AI
A reference monitor that is always invoked and analyzable structurally eliminates the non-atomic check-then-use pattern underlying TOCTOU.
Access enforcement that performs an atomic check-and-use decision directly stops the window in which a TOCTOU race can be exploited.
Process isolation limits the blast radius of a successful TOCTOU exploitation but does not remove the race itself.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly include coding standards and reviews that prevent TOCTOU race conditions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Reliable, synchronized time across systems narrows the exploitable window in which a resource state can change between a security check and its use.