Background exploitation KEV catalog

CVE-2025-38352

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

CheckOps priority index

4.4/10 Patch within 7 days

Severity7.8

Probability0.1

Exploitation2/5

Severity = CVSS. Probability = EPSS (FIRST). Exploitation = public signals: KEV, EUVD, ransomware, EPSS above 10 %, no account required.

EPSS · today 1.4% higher than 71.7% of CVEs

CVSS 3.1 7.8 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:

Exploited for 425 days 04 Sept 2025

CISA due date 25 Sept 2025 for US federal agencies

Exploitation probability EPSS · FIRST

EPSS probability (%)Percentile among all CVEs

Exploitation signals 2 / 5

KEV catalog (CISA)04 Sept 2025
Exploited in EUVD (ENISA)04 Sept 2025
Used by ransomwareno
EPSS above 10 %1.4%
No account, over the networkno

What to do

Fix

Apply the vendor’s fix as soon as it is available.

CISA guidance: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Meanwhile

Take the service off the internet or restrict access to it, watch the logs and look for signs of compromise.

Manufacturers (CRA)

Exploited vulnerability in your product: early warning to ENISA within 24 h, then notification within 72 h (Article 14 of the Cyber Resilience Act). The CRA explained

Description ENISA EUVD

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

Affected products

LinuxKernel

Affected versions

0bdd2ed4138ec04e09b4f8165981efc99e439f55 <c29d5318708e67ac13c1b6fc1007d179fb65b4d7
0bdd2ed4138ec04e09b4f8165981efc99e439f55 <c076635b3a42771ace7d276de8dc3bc76ee2ba1b
0bdd2ed4138ec04e09b4f8165981efc99e439f55 <2f3daa04a9328220de46f0d5c919a6c0073a9f0b
patch: 5.4.295
patch: 6.1.142
0bdd2ed4138ec04e09b4f8165981efc99e439f55 <78a4b8e3795b31dae58762bc091bb0f4f74a2200
patch: 6.16
patch: 0
patch: 6.6.94
patch: 6.15.3
patch: 5.10.239
patch: 5.15.186

Weaknesses (CWE)

CWE-367

Open source packages OSV

Affected libraries according to OSV, with fixed versions.

Timeline

22 Jul 2025
Published
04 Sept 2025
Exploitation reported (ENISA)
04 Sept 2025
Added to the KEV catalog
25 Sept 2025
CISA remediation due date

References

Other exploited vulnerabilities from the same vendor

CVE-2026-46300Linux Kernel Missing Initialization of a Variable Vulnerability
5.4 · Rising fast
CVE-2026-53266Linux Kernel Out-of-Bounds Write Vulnerability
4.7 · Actively exploited
CVE-2025-39964Linux Kernel Race Condition Vulnerability
4.4 · Actively exploited
CVE-2025-39682Linux Kernel Improper Check for Unusual or Exceptional Conditions Vulnerability
5.8 · Actively exploited
CVE-2026-53362Linux Kernel Unspecified Vulnerability
4.3 · Actively exploited
CVE-2022-0995Linux Kernel Out-of-Bounds Write Vulnerability
4.6 · Actively exploited