CVE-2025-38352: Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability
- Is it exploited?
Yes. CISA added it to the Known Exploited Vulnerabilities catalog on , 44 days after the CVE record was published.
- How likely is exploitation in the next 30 days?
- 1.4%
EPSS score, percentile 71.6 of all scored records
- How severe?
- 7.8 High
CVSS v3.1 base score, given by the CNA
- What should I do?
CISA deadline . Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
The CVE record links no vendor advisory, patch or mitigation.
- Which versions are affected?
Affected
- 2.6.36
Unaffected before 2.6.36; 5.4.295; 5.10.239; 5.15.186; 6.1.142; 6.6.94; and 3 more
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
What to do
Required action, set by CISA
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CISA due date for this action: .
Advisories and patches
The CVE record links no vendor advisory, patch or mitigation.
Linked from CISA's catalog entry
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff
- https://source.android.com/docs/security/bulletin/2025-09-01
- https://nvd.nist.gov/vuln/detail/CVE-2025-38352
Affected products and versions
As listed in the CVE record.
| Status | Versions |
|---|---|
| Affected | from 0bdd2ed4138e to before 78a4b8e3795b |
| Affected | from 0bdd2ed4138e to before c076635b3a42 |
| Affected | from 0bdd2ed4138e to before 2f3daa04a932 |
| Affected | from 0bdd2ed4138e to before 764a7a5dfda2 |
| Affected | from 0bdd2ed4138e to before 2c72fe18cc5f |
| Affected | from 0bdd2ed4138e to before c29d5318708e |
| Affected | from 0bdd2ed4138e to before 460188bc042a |
| Affected | from 0bdd2ed4138e to before f90fff1e152d |
Versions not listed are: unaffected.
| Status | Versions |
|---|---|
| Affected | 2.6.36 |
| Unaffected | before 2.6.36 |
| Unaffected | 5.4.295 |
| Unaffected | 5.10.239 |
| Unaffected | 5.15.186 |
| Unaffected | 6.1.142 |
| Unaffected | 6.6.94 |
| Unaffected | 6.12.34 |
| Unaffected | 6.15.3 |
| Unaffected | 6.16 |
Versions not listed are: affected.
Versions the record lists as unaffected: 5.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34, 6.15.3, 6.16.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
About this vulnerability
Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.
Summary: CISA's KEV catalog, as of .
- CISA added CVE-2025-38352 to its Known Exploited Vulnerabilities (KEV) catalog on 4 Sep 2025.
- CISA's ransomware flag for this entry is "Unknown": no evidence of ransomware use in the catalog, which is not proof of none.
- The due date CISA sets for the required action is 25 Sep 2025.
- The CVE record was published on 22 Jul 2025, 44 days before it was added to KEV.
- The CVE record carries a CVSS v3.1 base score of 7.8 (High), given by its CNA.
- FIRST's EPSS model puts the probability of exploitation in the next 30 days at 1.4% (percentile 71.6), as of 28 Oct 2026.
- CISA's SSVC assessment in the CVE record: exploitation active, automatable no, technical impact total.
Source: CISA Known Exploited Vulnerabilities (KEV) catalog, 2026.10.28, as of ; CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of ; FIRST Exploit Prediction Scoring System (EPSS), v2026.06.15, as of . About the data.
Description
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Source: CVE List V5 (CVE Program), cve_2026-10-28_0000Z, as of . About the data.
Weakness
- CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
CWE and CAPEC are maintained by MITRE; the entries are those named in the CVE record and the KEV entry.
Timeline
| Date | Event |
|---|---|
| CVE record published | |
| Added to CISA KEV | |
| CISA due date for the required action | |
| CVE record last updated |
References
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
- git.kernel.org
More exploited Linux vulnerabilities
- CVE-2026-46300: Linux Kernel Missing Initialization of a Variable Vulnerability
- CVE-2025-39682: Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
- CVE-2025-39964: Linux Kernel Race Condition Vulnerability
- CVE-2026-53266: Linux Kernel Out-of-Bounds Write Vulnerability
- CVE-2026-53362: Linux Kernel Unspecified Vulnerability
- CVE-2022-0995: Linux Kernel Out-of-Bounds Write Vulnerability