In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handleposixcputimers() and posixcputimerdel()
If an exiting non-autoreaping task has already passed exitnotify() and calls handleposixcputimers() from IRQ, it can be reaped by its parent or debugger right after unlocktasksighand().
If a concurrent posixcputimerdel() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cputimertaskrcu() and/or locktasksighand() will fail.
Add the tsk->exitstate check into runposixcputimers() to fix this.
This fix is not needed if CONFIGPOSIXCPUTIMERSTASKWORK=y, because exittaskwork() is called before exitnotify(). But the check still makes sense, taskworkadd(&tsk->posixcputimerswork.work) will fail anyway in this case.
[
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-0374d22c",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@764a7a5dfda23f69919441f2eac2a83e7db6e5bb",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-085ebd09",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-105611f2",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c076635b3a42771ace7d276de8dc3bc76ee2ba1b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "16260933335807227209560263460253600242",
"length": 599.0
},
"deprecated": false,
"id": "CVE-2025-38352-56bb926a",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78a4b8e3795b31dae58762bc091bb0f4f74a2200",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-6db45ab3",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@460188bc042a3f40f72d34b9f7fc6ee66b0b757b",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-7dc78303",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3daa04a9328220de46f0d5c919a6c0073a9f0b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-9ab74b47",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c29d5318708e67ac13c1b6fc1007d179fb65b4d7",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-9cf0657e",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@460188bc042a3f40f72d34b9f7fc6ee66b0b757b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-a7a126e4",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c076635b3a42771ace7d276de8dc3bc76ee2ba1b",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"338679409718996863242245101973400308825",
"202047586446349138349597478892060095311",
"60781261020553819812164066448487560596"
]
},
"deprecated": false,
"id": "CVE-2025-38352-aca59856",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@78a4b8e3795b31dae58762bc091bb0f4f74a2200",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-c385b8dd",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90fff1e152dedf52b932240ebbd670d83330eca",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-c51cf486",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@764a7a5dfda23f69919441f2eac2a83e7db6e5bb",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-cb53b87e",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c29d5318708e67ac13c1b6fc1007d179fb65b4d7",
"signature_type": "Line"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-cdd0e335",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@f90fff1e152dedf52b932240ebbd670d83330eca",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"function_hash": "328631927418429210242873994005901180136",
"length": 154.0
},
"deprecated": false,
"id": "CVE-2025-38352-f31ee45e",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff",
"signature_type": "Function"
},
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"id": "CVE-2025-38352-f3cd5c0f",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2f3daa04a9328220de46f0d5c919a6c0073a9f0b",
"signature_type": "Line"
}
]