CVE-2025-38352
9.5 CISA KEVLinux · Kernel
A Time-of-Check Time-of-Use (TOCTOU) race condition exists in the Linux kernel POSIX CPU timer subsystem, allowing local attackers to achieve privilege escalation or cause a denial of service.
Executive summary
This critical Linux kernel race condition is currently being exploited in the wild to facilitate local privilege escalation, necessitating immediate patching.
Vulnerability
The vulnerability is a TOCTOU race condition occurring between the handle_posix_cpu_timers() and posix_cpu_timer_del() functions within the POSIX CPU timer subsystem. A local attacker can trigger this flaw during process exit to manipulate task states, potentially resulting in arbitrary code execution with kernel privileges.
Business impact
The vulnerability carries a CVSS score of 9.5, reflecting its critical potential for full system compromise. Successful exploitation grants an attacker kernel-level access, allowing for complete control over the affected system, data exfiltration, or persistent denial of service. Given its inclusion in the CISA KEV catalog and active exploitation in the wild, the business risk is extreme, particularly for organizations deploying Android or Linux-based infrastructure.
Remediation
Immediate Action: Update the Linux kernel to version 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, or a newer stable release provided by your distribution vendor.
Proactive Monitoring: Monitor system logs for unexpected kernel panics, segmentation faults, or unauthorized privilege escalation attempts that may indicate exploitation of the POSIX timer subsystem.
Compensating Controls: Restrict local shell access to untrusted users and ensure that security-hardened kernel configurations are enforced to limit the impact of potential race condition exploits.
Exploitation status
Public Exploit Available: Yes, multiple public proofs-of-concept are available via GitHub repositories.
Analyst recommendation
Due to the confirmed active exploitation of this kernel flaw and its potential for full system takeover, immediate remediation is mandatory. System administrators should prioritize patching all affected Linux and Android deployments to the specified versions or higher. Failure to apply these updates leaves systems vulnerable to trivial local privilege escalation attacks that are currently being leveraged in the wild.