CVE
CVE-2025-38352
Linux · Linux
- First Reported
- Mar 6, 2026
- Latest Reported
- Mar 6, 2026
CVE Enrichment
- CVSS
- 7.8 HIGH
- EPSS
- 1.36%
- EPSS Percentile
- 71.86%
- CISA KEV
- YES — Known Exploited Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Technical Details
- CVSS Version
- 3.1
- CNA / NVD Source
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- Published
- 22-Jul-2025 15:15
- Last Modified
- 09-Sep-2026 01:17
- EPSS Date
- 2026-11-09
- CWE
- CWE-367
CVSS Vector
CVSS:3.1 AV:L /
AC:L /
PR:L /
UI:N /
S:U /
C:H /
I:H /
A:H
CISA KEV Details
- Date Added
- 2025-09-04
- Remediation Due
- 2025-09-25
- Known Ransomware Campaign Use
- Unknown
- Required Action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Notes
- This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff ; https://source.android.com/docs/security/bulletin/2025-09-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-38352
CNA Products / Version Status
- Linux · Linux
Source: CNA · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Default status: affected
2.6.36 — affected
0 ≤ version < 2.6.36 — unaffected (semver)
5.4.295 ≤ version ≤ 5.4.* — unaffected (semver)
5.10.239 ≤ version ≤ 5.10.* — unaffected (semver)
5.15.186 ≤ version ≤ 5.15.* — unaffected (semver)
6.1.142 ≤ version ≤ 6.1.* — unaffected (semver)
6.6.94 ≤ version ≤ 6.6.* — unaffected (semver)
6.12.34 ≤ version ≤ 6.12.* — unaffected (semver)
6.15.3 ≤ version ≤ 6.15.* — unaffected (semver)
6.16 ≤ version ≤ * — unaffected (original_commit_for_fix)
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Linux · Linux
Source: CNA · 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Default status: unaffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < 78a4b8e3795b31dae58762bc091bb0f4f74a2200 — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < c076635b3a42771ace7d276de8dc3bc76ee2ba1b — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < 2f3daa04a9328220de46f0d5c919a6c0073a9f0b — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < 764a7a5dfda23f69919441f2eac2a83e7db6e5bb — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < c29d5318708e67ac13c1b6fc1007d179fb65b4d7 — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < 460188bc042a3f40f72d34b9f7fc6ee66b0b757b — affected (git)
0bdd2ed4138ec04e09b4f8165981efc99e439f55 ≤ version < f90fff1e152dedf52b932240ebbd670d83330eca — affected (git)
repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected Products / Versions
- linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 2.6.36 · before (exclusive) 5.4.295
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.5 · before (exclusive) 5.10.239
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.11 · before (exclusive) 5.15.186
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 5.16 · before (exclusive) 6.1.142
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.2 · before (exclusive) 6.6.94
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.7 · before (exclusive) 6.12.34
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: * · from (inclusive) 6.13 · before (exclusive) 6.15.3
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - linux / linux_kernel
Source: NVD CPE · affected
Version / affected range: 6.16
cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:* - debian / debian_linux
Source: NVD CPE · affected
Version / affected range: 11.0
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
References
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
- af854a3a-2127-422b-91ae-364da2661108
- af854a3a-2127-422b-91ae-364da2661108
- 134c704f-9b21-4f2e-91b3-4a467353bcc0
- CISA Advisory
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.
Reported Context (1)
- We observed in-the-wild exploitation of this vulnerability in a chain with vulnerabilities in the Chrome renderer (CVE-2025-5419) and in the Linux kernel’s posix CPU timers implementation (CVE-2025-38352). Google GTIG Tracked 90 Zero-Days in 2025 as Enterprise Exploitation Reached a Record Share
CVE (14)
Malware (1)
Threat Actors (10)
MITRE ATT&CK (6)
Vendors (6)
Products (6)
Tools (1)
Industries (1)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.