HIGH CISA KEV Public exploit Introduced in 2.6.36
posix-cputimers ExitTask Race
CVE-2025-38352
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.8HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
02KernelScan AI Analysis
Risk summary
A local unprivileged attacker can exploit a race condition in the POSIX CPU timers subsystem to achieve kernel-level code execution or denial of service. The vulnerability exists in all supported stable kernels since 2.6.36, has a public exploit, and is listed in CISA's Known Exploited Vulnerabilities catalog.
Vulnerability analysis
When a process is exiting and has already notified its parent or debugger that it is dead, a CPU timer interrupt can still fire and begin processing the task's pending POSIX CPU timers. During this window, the parent or debugger can reap the exiting task, freeing its associated structures. If another thread concurrently attempts to delete one of these timers, the deletion path fails to detect that the timer is actively firing because it can no longer lock the dying task's signal handler, resulting in a use-after-free on the timer and task structures. The fix adds an early exit check so that timer processing is skipped entirely when the task has already entered its exit state, closing the race window. Any local unprivileged user can trigger this by creating POSIX CPU timers and orchestrating process exit timing; no special hardware or configuration is required.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 2.6.36 | 5.10.239 | c076635b3a42 |
| 5.15 | 2.6.36 | 5.15.186 | 2f3daa04a932 |
| 5.4 | 2.6.36 | 5.4.295 | 78a4b8e3795b |
| 6.1 | 2.6.36 | 6.1.142 | 764a7a5dfda2 |
| 6.12 | 2.6.36 | 6.12.34 | c29d5318708e |
| 6.15 | 2.6.36 | 6.15.3 | 460188bc042a |
| 6.6 | 2.6.36 | 6.6.94 | 2c72fe18cc5f |
| mainline | 2.6.36 | 6.16 | f90fff1e152d |
| cip/4.19 | 2.6.36 | 4.19.325-cip122 | e43787b92b7f |
| cip/4.19-rt | 2.6.36 | 4.19.325-cip122-rt43 | e43787b92b7f |
| cip/4.4 | 2.6.36 | 4.4.302-cip101 | 1088981f3e49 |
| cip/4.4-rt | 2.6.36 | 4.4.302-cip102-rt57 | 1088981f3e49 |
| cip/5.10 | 2.6.36 | 5.10.239-cip62 | c076635b3a42 |
| cip/5.10-rt | 2.6.36 | 5.10.239-cip62-rt27 | c076635b3a42 |
| cip/6.1 | 2.6.36 | 6.1.145-cip44 | 764a7a5dfda2 |
| cip/6.1-rt | 2.6.36 | 6.1.151-cip46-rt24 | 764a7a5dfda2 |
| cip/6.12 | 2.6.36 | 6.12.34-cip3 | c29d5318708e |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.34-cip3 |
| cip/6.1 | Fixed in 6.1.145-cip44 |
| cip/6.1-rt | Fixed in 6.1.151-cip46-rt24 |
| cip/5.10 | Fixed in 5.10.239-cip62 |
| cip/5.10-rt | Fixed in 5.10.239-cip62-rt27 |
| cip/4.19 | Fixed in 4.19.325-cip122 |
| cip/4.19-rt | Fixed in 4.19.325-cip122-rt43 |
| cip/4.4 | Fixed in 4.4.302-cip101 |
| cip/4.4-rt | Fixed in 4.4.302-cip102-rt57 |