posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's POSIX CPU timer code (posix-cpu-timers) is affected, where a race between timer handling and timer deletion for exiting tasks could let a timer be handled on a task that has already been reaped. The impact is a potential kernel-level race condition that may cause incorrect timer state or memory-safety problems in the kernel.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
Affected versions
- Linux Linux
From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in 78a4b8e3795b31dae58762bc091bb0f4f74a2200; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in c076635b3a42771ace7d276de8dc3bc76ee2ba1b; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in 2f3daa04a9328220de46f0d5c919a6c0073a9f0b; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in 764a7a5dfda23f69919441f2eac2a83e7db6e5bb; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in c29d5318708e67ac13c1b6fc1007d179fb65b4d7; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in 460188bc042a3f40f72d34b9f7fc6ee66b0b757b; From 0bdd2ed4138ec04e09b4f8165981efc99e439f55 · fixed in f90fff1e152dedf52b932240ebbd670d83330eca
- Linux Linux
2.6.36
References 8
git.kernel.org
- stable/c/78a4b8e3795b31dae58762bc091bb0f4f74a2200
- stable/c/c076635b3a42771ace7d276de8dc3bc76ee2ba1b
- stable/c/2f3daa04a9328220de46f0d5c919a6c0073a9f0b
- stable/c/764a7a5dfda23f69919441f2eac2a83e7db6e5bb
- stable/c/2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff
- stable/c/c29d5318708e67ac13c1b6fc1007d179fb65b4d7
- stable/c/460188bc042a3f40f72d34b9f7fc6ee66b0b757b
- stable/c/f90fff1e152dedf52b932240ebbd670d83330eca
Questions about CVE-2025-38352
What does this mean?
The kernel's POSIX CPU timer code has a race between handle_posix_cpu_timers() and posix_cpu_timer_del(). It occurs when an exiting task that is non-autoreaping has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ context. The advisory's stated impact is not included in the checked facts.Source: git.kernel.org
Am I affected, and how do I check?
Linux kernel versions from commit 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to the per-branch fixing commits, which are listed in the affected ranges. To check a system, compare the running kernel version and its git history against those commits, for example with git merge-base or git branch --contains on the fixing commit.Source: git.kernel.org
What should I do about it?
Update to a kernel release that includes the fixing commit for your stable branch. The checked facts do not name specific fixed release numbers, so use the vendor or distribution kernel that carries the listed commit.Source: git.kernel.org
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-09-04, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data