Published
2025-07-22
·
Updated
2025-09-27
·
CVE-2025-38352
7.4
High
| Base vector | Vector | AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
**Name of the Vulnerable Software and Affected Versions**
Linux kernel versions prior to 6.1.147-1
Linux kernel versions prior to 6.6.101
**Description**
The Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability in the `posix-cpu-timers` subsystem. This flaw is present in the `handle posix cpu timers()` and `posix cpu timer del()` functions. The vulnerability occurs when these functions run concurrently on an exiting task, potentially leading to a use-after-free scenario. Exploitation of this vulnerability could allow a local attacker to escalate privileges or cause a system crash. This vulnerability is actively exploited.
**Recommendations**
Upgrade the Linux kernel to version 6.1.147-1 or later.
Upgrade the Linux kernel to version 6.6.101 or later.
Fix
Time Of Check To Time Of Use
Race Condition