Evidence dossier

CVE-2025-38352

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

60.8–75.8Priority evidence range

As known Jul 19, 2026, 5:00 AM UTCgen-56ccdaf9

Normalized restatement

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

State: PUBLISHED
Published: Jul 22, 2025
Updated: May 11, 2026
Evidence coverage: 85%

CISA KEVCatalog member

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

FIRST EPSS1.34%

2026-07-18 · v2026.06.15 · percentile 68.3%

Source stateNo scored conflict

Distinct CVSS assessments remain side by side; none are averaged.

Source comparison

Who said what

CISA-ADPindependent enrichment

container

CISA ADP Vulnrichment

Jul 19, 2026Original evidence ↗

CVEderivative copy

container

CVE Program Container

Jul 19, 2026Original evidence ↗

Linuxoriginal assertion

container

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

Jul 19, 2026Original evidence ↗

CISA KEVoriginal assertion

observed_exploitation

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Jul 19, 2026Original evidence ↗

FIRST EPSSoriginal assertion

model_probability

Probability 0.013450000000; percentile 0.682520000000

Jul 19, 2026Original evidence ↗

Applicability

Cited product scope

Trace impact →

LinuxLinux

[{"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "78a4b8e3795b31dae58762bc091bb0f4f74a2200", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "c076635b3a42771ace7d276de8dc3bc76ee2ba1b", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "2f3daa04a9328220de46f0d5c919a6c0073a9f0b", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "764a7a5dfda23f69919441f2eac2a83e7db6e5bb", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "c29d5318708e67ac13c1b6fc1007d179fb65b4d7", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "460188bc042a3f40f72d34b9f7fc6ee66b0b757b", "versionType": "git"}, {"status": "affected", "version": "0bdd2ed4138ec04e09b4f8165981efc99e439f55", "lessThan": "f90fff1e152dedf52b932240ebbd670d83330eca", "versionType": "git"}]

unknown

LinuxLinux

[{"status": "affected", "version": "2.6.36"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.36", "versionType": "semver"}, {"status": "unaffected", "version": "5.4.295", "versionType": "semver", "lessThanOrEqual": "5.4.*"}, {"status": "unaffected", "version": "5.10.239", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.186", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.142", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.94", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.34", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.15.3", "versionType": "semver", "lessThanOrEqual": "6.15.*"}, {"status": "unaffected", "version": "6.16", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}]

unknown