Skip to content

CVE-2025-38352 — Linux Kernel POSIX CPU Timers Race Condition / Use-After-Free

Key facts

CVE-2025-38352 is a High (7.0) vulnerability: Linux Kernel POSIX CPU Timers Race Condition / Use-After-Free. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-09-04), confirming active exploitation in the wild.

Actively exploited — on the CISA KEV catalog

CVE-2025-38352 is listed on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-09-04), confirming exploitation in the wild. Federal remediation deadline: 2025-09-25. Prioritise patching and deploy the detection and prevention rules below.
CVE CVE-2025-38352
Severity High (7.0)
CISA KEV Actively exploited (added 2025-09-04)
Detection / prevention —
PoC poc.py
Source 2025/CVE-2025-38352/

Details

CVSS Type

Overview

Attribute Value
CVE ID CVE-2025-38352
Severity High
CVSS Score 7.0
Affected Product Linux Kernel POSIX CPU Timers
Vulnerability Type Race Condition / Use-After-Free
CWE CWE-362

Description

Race condition vulnerability in Linux kernel's POSIX CPU timer implementation. Public PoC exploit available. Particularly affects 32-bit Android devices.

Affected Versions

  • Linux Kernel with CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled

Verification Process

The PoC uses a multi-stage verification approach:

Step 1: Product/Version Detection (Passive)

[*] Query target endpoint
[*] Detect product signatures and extract version
[*] Check if version is in vulnerable range

Step 2: Active Vulnerability Testing

Method Description Detection
Error-based Inject payloads that trigger error messages Error indicators in response
Timing-based Inject delay commands and measure response Response time > baseline + delay
Response-based Check for expected patterns in response Pattern match in response body
Callback-based Trigger OOB request to attacker server HTTP request received

Verification Flow

┌─────────────────────────────────────────────────────────────┐
│                    Product Detection                         │
│  Query target → Detect product/version                      │
│  Check if version in vulnerable range                       │
└─────────────────────────────────────────────────────────────┘
                              ↓
┌─────────────────────────────────────────────────────────────┐
│               Active Vulnerability Testing                   │
│                                                              │
│  1. Error-based Test                                         │
│     └─ Send payload → Check for error indicators            │
│     └─ If error found → CONFIRMED VULNERABLE                │
│                                                              │
│  2. Timing-based Test                                        │
│     └─ Send delay payload → Measure response time           │
│     └─ If delayed → CONFIRMED VULNERABLE                    │
│                                                              │
│  3. Callback-based Test (if URL provided)                    │
│     └─ Send OOB payload → Check callback server             │
│     └─ If request received → CONFIRMED VULNERABLE           │
└─────────────────────────────────────────────────────────────┘

Usage

# Full vulnerability check (version + active testing)
python3 poc.py -t https://target.com -c

# Version-only check (passive, no payloads sent)
python3 poc.py -t https://target.com -c --version-only

# With OOB callback (most reliable)
python3 poc.py -t https://target.com -c --callback http://your-server.com

Mitigation

  1. Upgrade to the latest patched version
  2. Apply workarounds if patch unavailable
  3. Monitor for exploitation attempts
  4. Network segmentation to limit exposure

References

Frequently asked questions

What is CVE-2025-38352?

CVE-2025-38352 is a High (7.0) vulnerability: Linux Kernel POSIX CPU Timers Race Condition / Use-After-Free. This entry ships a detection-only PoC. It is on the CISA Known Exploited Vulnerabilities (KEV) catalog (added 2025-09-04), confirming active exploitation in the wild.

How do I detect CVE-2025-38352?

Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.

How do I block or mitigate CVE-2025-38352?

Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.

Is CVE-2025-38352 actively exploited?

Yes. CVE-2025-38352 is on the CISA Known Exploited Vulnerabilities (KEV) catalog, added 2025-09-04, which means it has been exploited in the wild. CISA set a federal remediation deadline of 2025-09-25. Prioritise patching and deploy the detection and prevention rules above.

For authorized security testing and research only. See the full source and NVD record.