Race Condition Vulnerability in Linux Kernel - CVE-2025-38352
Summary
CVE-2025-38352: In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of many operating systems, providing essential services for hardware management and system resources. It is known for its robustness and flexibility, supporting a wide range of devices and architectures. However, like any complex software, it is susceptible to vulnerabilities that can affect system stability and security. CVE-2025-38352 specifically addresses a race condition that can occur in the handling of POSIX CPU timers, which may lead to unexpected behavior in task management.
Vulnerability Detail
CVE-2025-38352 is a race condition vulnerability in the Linux kernel's handling of POSIX CPU timers. It arises when an exiting non-autoreaping task calls handle_posix_cpu_timers() from an interrupt context after it has passed exit_notify(). If a concurrent call to posix_cpu_timer_del() occurs at this moment, it may fail to detect the firing state of the timer, leading to potential task management issues. This can result in improper cleanup of resources and may expose the system to further instability or security risks.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is recommended to apply the patch as soon as it is available to mitigate any risks associated with this issue.
Conclusion
CVE-2025-38352 is a significant vulnerability in the Linux kernel that requires immediate attention. Users should ensure they are running the patched version of the Linux package to protect their systems from potential exploitation. Regular updates and monitoring for vulnerabilities are essential practices for maintaining system security.
See every vulnerability recorded for linux →
FAQ
CVE-2025-38352 is a race condition vulnerability in the Linux kernel related to the handling of POSIX CPU timers.
If exploited, this vulnerability can lead to improper task management and potential system instability.
Yes, the patched version of the Linux package is 6.12.35-1. Users should update to this version to mitigate the vulnerability.
While there are no specific workarounds, it is crucial to monitor the situation and apply the patch as soon as possible.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
