In the Linux kernel, the following vulnerability has been resolved:
posix-cpu-timers: fix race between handleposixcputimers() and posixcputimerdel()
If an exiting non-autoreaping task has already passed exitnotify() and calls handleposixcputimers() from IRQ, it can be reaped by its parent or debugger right after unlocktasksighand().
If a concurrent posixcputimerdel() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cputimertaskrcu() and/or locktasksighand() will fail.
Add the tsk->exitstate check into runposixcputimers() to fix this.
This fix is not needed if CONFIGPOSIXCPUTIMERSTASKWORK=y, because exittaskwork() is called before exitnotify(). But the check still makes sense, taskworkadd(&tsk->posixcputimerswork.work) will fail anyway in this case.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/38xxx/CVE-2025-38352.json"
}[
{
"signature_version": "v1",
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38352-085ebd09",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"239550998081870972127451971872312053997",
"147150368589273284825147366725515272174",
"82833152002525841078026884179897054603"
]
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Line",
"id": "CVE-2025-38352-105611f2",
"target": {
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c076635b3a42771ace7d276de8dc3bc76ee2ba1b"
},
{
"signature_version": "v1",
"digest": {
"length": 154.0,
"function_hash": "328631927418429210242873994005901180136"
},
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38352-a7a126e4",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c076635b3a42771ace7d276de8dc3bc76ee2ba1b"
},
{
"digest": {
"length": 154.0,
"function_hash": "328631927418429210242873994005901180136"
},
"signature_version": "v1",
"deprecated": false,
"signature_type": "Function",
"id": "CVE-2025-38352-f31ee45e",
"target": {
"function": "run_posix_cpu_timers",
"file": "kernel/time/posix-cpu-timers.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff"
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-38352.json"