Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
Linux Linux — posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
AV AC PR UI S C I A CVSS EPSS %ile KEV
L L L N U H H H 7.8 .0128 67.7 YES
AFFECTED
Product Versions Fixed
Linux 0bdd2ed4138ec04e09b4f8165981efc99e439f55 – —
Linux 2.6.36 – 5.4.295
TIMELINE
Apr 16 Reserved by Linux
Sep 4 Added to CISA KEV, remediation due 2025-09-25
Sep 4 Published (CNA: Linux)
Jul 29 EXPLOIT PUBLISHED — CVE-2025-38352 (Linux). Public exploit reference added.
Jul 29 PATCH SHIPPED — CVE-2025-38352 (Linux). Fixed in Linux 5.4.295.
Description
In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()
If an exiting non-autoreaping task has already passed exit_notify() and
calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent
or debugger right after unlock_task_sighand().
If a concurrent posix_cpu_timer_del() runs at that moment, it won't be
able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or
lock_task_sighand() will fail.
Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.
This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because
exit_task_work() is called before exit_notify(). But the check still
makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail
anyway in this case.
Lifecycle
Complete event history — 5 events, chronological
| Date | Event | Detail |
|---|
| April 16, 2025 | Reserved | Reserved by Linux |
| September 4, 2025 | KEV ADDED | Added to CISA KEV, remediation due 2025-09-25 |
| September 4, 2025 | Published | Published (CNA: Linux) |
| July 29, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2025-38352 (Linux). Public exploit reference added. |
| July 29, 2026 | PATCH SHIPPED | PATCH SHIPPED — CVE-2025-38352 (Linux). Fixed in Linux 5.4.295. |
Affected
Affected products and packages — 2 rows
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|
| Linux | Linux | — | 0bdd2ed4138ec04e09b4f8165981efc99e439f55 | — |
| Linux | Linux | — | 2.6.36 | 5.4.295 |
About this page
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2025-38352 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.