CVE-2025-38352
HIGH KEVLinux Kernel - Time-of-check Time-of-use Race Condition in POSIX CPU Timers
Title source: llmExploitation Summary
CVE-2025-38352 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 4, 2025. EIP tracks 8 public exploits from researchers including farazsth98, AnalyticETH, adminlove520.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2025-38352, targeting a race condition in the Linux kernel's POSIX CPU timers. The exploit achieves local privilege escalation (LPE) by manipulating kernel structures through a use-after-free (UAF) vulnerability.
Description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Exploits (8)
This repository contains a functional exploit for CVE-2025-38352, targeting a race condition in the Linux kernel's POSIX CPU timers. The exploit achieves local privilege escalation (LPE) by manipulating kernel structures through a use-after-free (UAF) vulnerability.
This repository contains a proof-of-concept exploit for CVE-2025-38352, a race condition vulnerability in the Linux kernel's POSIX CPU timers implementation. The PoC triggers a use-after-free of a `struct k_itimer` by manipulating CPU timer handling in a multi-threaded environment.
This repository contains a functional exploit for CVE-2025-38352, a local privilege escalation vulnerability in LG webOS kernel 5.4.268-320. The exploit leverages a POSIX CPU timer race condition to achieve use-after-free on a struct sigqueue object, leading to arbitrary kernel write and root privilege escalation.
The repository contains functional exploit code for multiple CVEs, including authentication bypass vulnerabilities in TOTOLINK devices and a scanner for Fortinet SSL VPN (CVE-2024-21762). The PoCs demonstrate the vulnerabilities with clear technical details and functional code.
This repository contains a proof-of-concept exploit for CVE-2025-38352, targeting a vulnerability in Linux kernel version 5.10.x on Android devices. The exploit leverages a race condition to achieve local privilege escalation (LPE) by manipulating timers and signal queues.
This repository contains a functional PoC exploit for CVE-2025-38352, targeting an out-of-bounds read/write vulnerability in the KGSL driver on Honor Magic V2 devices. The exploit demonstrates kernel memory access via crafted IOCTL calls and includes a detailed technical writeup.
The repository lacks actual exploit code and instead directs users to download a precompiled binary from an external release page. The README is marketing-focused with no technical details about CVE-2025-38352.
This repository contains a proof-of-concept exploit for CVE-2025-38352, targeting a vulnerability in the Linux kernel's POSIX CPU timers implementation. The exploit demonstrates a race condition that could allow unauthorized access to system resources.
References (12)
Scores
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H