CVE-2025-38352

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

State: Published
Severity: 7.8 High
Published: Jul 22, 2025
Updated: Sep 8, 2026
Reserved: Apr 16, 2025

Description

In the Linux kernel, the following vulnerability has been resolved:

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

Affected Products

Product	Versions
LinuxLinux	0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 78a4b8e3795b31dae58762bc091bb0f4f74a2200Affected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before c076635b3a42771ace7d276de8dc3bc76ee2ba1bAffected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 2f3daa04a9328220de46f0d5c919a6c0073a9f0bAffected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 764a7a5dfda23f69919441f2eac2a83e7db6e5bbAffected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ffAffected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before c29d5318708e67ac13c1b6fc1007d179fb65b4d7Affected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 460188bc042a3f40f72d34b9f7fc6ee66b0b757bAffected 0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before f90fff1e152dedf52b932240ebbd670d83330ecaAffected
LinuxLinux	2.6.36Affected before 2.6.36Not affected 5.4.295 through 5.4.Not affected 5.10.239 through 5.10.Not affected 5.15.186 through 5.15.Not affected 6.1.142 through 6.1.Not affected 6.6.94 through 6.6.Not affected 6.12.34 through 6.12.Not affected 6.15.3 through 6.15.*Not affected 6.16 and laterNot affected

Product

Versions

LinuxLinux

0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 78a4b8e3795b31dae58762bc091bb0f4f74a2200Affected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before c076635b3a42771ace7d276de8dc3bc76ee2ba1bAffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 2f3daa04a9328220de46f0d5c919a6c0073a9f0bAffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 764a7a5dfda23f69919441f2eac2a83e7db6e5bbAffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ffAffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before c29d5318708e67ac13c1b6fc1007d179fb65b4d7Affected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before 460188bc042a3f40f72d34b9f7fc6ee66b0b757bAffected
0bdd2ed4138ec04e09b4f8165981efc99e439f55 to before f90fff1e152dedf52b932240ebbd670d83330ecaAffected

LinuxLinux

2.6.36Affected
before 2.6.36Not affected
5.4.295 through 5.4.*Not affected
5.10.239 through 5.10.*Not affected
5.15.186 through 5.15.*Not affected
6.1.142 through 6.1.*Not affected
6.6.94 through 6.6.*Not affected
6.12.34 through 6.12.*Not affected
6.15.3 through 6.15.*Not affected
6.16 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.