CVE-2025-38352

CVE-2025-38352 is a time-of-check to time-of-use (TOCTOU) race condition (CWE-367) in the Linux kernel's POSIX CPU timers subsystem: when an exiting non-auto-reaping task has passed exit_notify() and handles CPU timers from interrupt context, it can be reaped by its parent or debugger right after unlock_task_sighand(), so a concurrent posix_cpu_timer_del() cannot detect that the timer is firing (cpu_timer_task_rcu() and/or lock_task_sighand() fail). A local attacker with low privileges who can manipulate POSIX CPU timers on such a task can win this race window, with high impact to confidentiality, integrity, and availability (CVSS 3.1: 7.8, local vector, no user interaction). Any system running an affected Linux kernel is exposed, including Debian GNU/Linux deployments and Android devices built on the kernel; practical reachability is limited where CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y routes timer handling through task work instead of IRQ context. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-09-04 and Google shipped it as an actively exploited fix in the September 2025 Android security update; EPSS currently estimates a 1.3% probability of exploitation within 30 days (68th percentile), and a public proof-of-concept is available.

What to do: Apply updated kernel packages from your distribution (Debian and other vendors ship the upstream posix-cpu-timers fix) and install Google's September 2025 Android security patch on Android devices; CISA KEV listing requires federal agencies to apply vendor mitigations or discontinue use per BOD 22-01. Because exploitation requires local code execution, prioritize multi-tenant servers, build/CI hosts, and devices where untrusted users or apps run local code. A public proof-of-concept (github.com/farazsth98/chronomaly) is available for validation testing.