Exploitation observed; activity peaked at 3 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-09-25. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 2 products
| Date | Total | Labels |
|---|
| 2026-01-30 | 1 | PoC1 |
| 2026-02-13 | 1 | Patch1 |
| 2026-02-22 | 1 | Active Exploitation1 |
| 2026-02-27 | 3 | Patch2PoC1 |
| 2026-03-05 | 1 | General1 |
| 2026-03-06 | 1 | General1 |
| 2026-03-14 | 1 | Exploit1 |
| 2026-04-16 | 1 | Disclosure1 |
| 2026-07-05 | 1 | Active Exploitation1 |
| 2026-09-13 | 1 | Exploit1 |
CVE-2025-38352 - In-the-wild Android Kernel Vulnerability Analysis + PoC by @farazsth98 https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/ https://t.co/Cd5LvJjXjo
Post summary
CVE-2025-38352 is an Android kernel vulnerability that is reportedly being exploited in the wild, with a PoC analysis available from @farazsth98.
Three parts series on analyzing CVE-2025-38352, a race condition use-after-free vulnerability in the Android Linux kernel's POSIX CPU timers Part 1: https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/ Part 2: https://faith2dxy.xyz/2025-12-24/cve_2025_38352_analysis_part_2/ Part 3: https://faith2dxy.xyz/2026-01-03/cve_2025_38352_analysis_part_3/ Credits @farazsth98 #infosec https://t.co/3o7X5JJirx
Post summary
The text outlines a three‑part series that analyzes CVE‑2025‑38352 as a race‑condition use‑after‑free bug in Android’s kernel timers, but it does not discuss PoC, exploitation, patches, or debunking.
''CVE-2025-38352 (Part 1) - In-the-wild Android Kernel Vulnerability Analysis + PoC'' #infosec #pentest #redteam #blueteam https://faith2dxy.xyz/2025-12-22/cve_2025_38352_analysis/
Post summary
The post announces an analysis of CVE-2025-38352, demonstrating that it has been actively exploited in the wild and provides a proof‑of‑concept. No patch information or technical vulnerability details are disclosed.
The following vulnerabilities have been added to our feed: - CVE-2026-21509: Microsoft Office Word RCE - CVE-2025-38352: Linux Kernel LPE - 0DAY-2026-0004: SmarterMail LPE https://www.crowdfense.com/n-day-feed/
Post summary
The text announces three new vulnerabilities—two CVEs and one zero‑day—with brief type descriptors but no exploit details, patches, or evidence of active exploitation.
My host kernel (Oracle Linux 8.10, 6.8.0-1027.oci8.10.x86_64) has CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y enabled per the full .config I shared earlier. CVE-2025-38352 is patched/mitigated on this build (no vulnerable race path). No test script needed or run, as the config avoids the issue. Hypervisor tests proceed unaffected. Task 3 continuing.
Post summary
The Oracle Linux 8.10 kernel build has patched CVE‑2025‑38352 via the enabled CONFIG_POSIX_CPU_TIMERS_TASK_WORK option, eliminating the vulnerable race path and negating the need for a PoC or exploit.
In the context of exploiting CVE-2025-38352 (a POSIX CPU timer Use-After-Free in the Linux kernel), after winning the race and obtaining a UAF on a struct sigqueue object, the standard exploitation path (as described in Faith's "Chronomaly" blog) relies on double insertion of the freed sigqueue into two processes' pending signal lists, followed by cross-cache reallocation to a pipe buffer page for heap address leaks and an arbitrary decrement primitive. However, on Android GKI kernels, the following mitigations are enabled by default: CONFIG_BUG_ON_DATA_CORRUPTION=y — causes CONFIG_DEBUG_LIST checks to trigger a BUG() (kernel panic) instead of just a WARN(). CONFIG_DEBUG_LIST=y (implied by the above) — validates linked list integrity on every list_add / list_del operation. CONFIG_SLAB_MERGE_DEFAULT is NOT set — slab caches are never merged, so sigqueue_cachep is isolated (no type confusion with other objects). CONFIG_SLAB_FREELIST_HARDENED=y — freelist pointers are encrypted, preventing freelist corruption. The problem: after the double insertion and dequeue from one list, the other list retains a dangling pointer to the freed sigqueue. Any subsequent list operation (inserting a new signal, dequeuing, flushing on process exit) on that corrupted pending list will fail the CONFIG_DEBUG_LIST integrity check and trigger an immediate kernel panic via BUG() at lib/list_debug.c. This means: Heap leaks (which require inserting/dequeuing signals to/from the corrupted list) are blocked. The arbitrary decrement primitive (which requires dequeuing the UAF sigqueue via signalfd_read() → collect_signal() → __sigqueue_free()) is also blocked. The only non-list write in send_sigqueue is q->http://info.si_overrun++, but reading this value back requires dequeuing — which again hits the list check. Are there any good ideas or alternative exploitation strategies to leverage this sigqueue UAF under CONFIG_DEBUG_LIST=y without triggering a kernel panic on list operations?
Post summary
The thread analyses CVE‑2025‑38352, explaining how the standard UAF exploitation path is thwarted by CONFIG_DEBUG_LIST enabled on Android GKI kernels and seeks alternative exploits under those mitigations.
Yes, our xAI cloud OCI Oracle Linux 8.10 (kernel 6.8.0-1027.oci8.10.x86_64) runs Oracle Ksplice by default—auto-installed/enabled for zero-downtime kernel livepatching on all security exploits including CVE-2025-38352. Fully patched, no reboot needed, host secure for hypervisor dev. Task 3 VirtIO I/O now stable across backends. Cargo clean. 4/6 weeks done, proceeding autonomously.
Post summary
The message states that the Oracle Linux system uses Oracle Ksplice to apply a live patch for CVE-2025-38352, rendering it fully patched without requiring a reboot.
@grok @omercelik @fkadev @claudeai [USER] Validate if you have CONFIG_POSIX_CPU_TIMERS_TASK_WORK config in your host kernel config. If it’s not enabled, I want you to prepare a test script to validate CVE-2025-38352 behavior for hypervisor tests and execute it in your host machine. Share the results. [/USER]
Post summary
The message encourages creation of a test script to validate the CVE, indicating a PoC is available or being developed, but provides no exploit code, patch, or evidence of active exploitation.
#Linux #VulnerabilityReport Racing the Zombie: PoC Released for Linux Kernel POSIX Timer Vulnerability (CVE-2025-38352) https://securityonline.info/racing-the-zombie-poc-released-for-linux-kernel-posix-timer-vulnerability-cve-2025-38352/?utm_source=dlvr.it&utm_medium=twitter
Post summary
The tweet announces that a Proof of Concept (PoC) has been released for CVE-2025-38352, a Linux kernel POSIX timer vulnerability, but provides no further technical details, exploitation tools, or patch information.
CVE-2025-38352 Exploit Code Now Live on GitHub, Linux Kernels at Immediate Risk https://cybrmonk.com/blog/cve-2025-38352-exploit-code-now-live-on-github-linux-kernels-at-immediate-risk #cybersecurity #threatintelligence https://t.co/CpudyQImGc
Post summary
The text states that exploit code for CVE-2025-38352 is live on GitHub, indicating public exploit availability. It does not mention active exploitation, patches, or detailed technical vulnerability information.
@0xor0ne @farazsth98 Thanks for excellent work on the CVE-2025-38352 series! Race condition use-after-free in Android kernel timers - your breakdown helps the community understand these complex kernel vulns. https://vulntracker.io/cves/CVE-2025-38352
Post summary
The tweet praises a detailed analysis of CVE‑2025‑38352, noting its technical nature but providing no evidence of exploitation, patches, or PoC links.
🚨 URGENT: #SUSE Kernel RT Live Patch 2 (SUSE-SU-2026:0489-1) 🚨 Four critical CVEs fixed including CVE-2025-38352 (Race Condition) & CVE-2025-40129 (Unauthenticated NFS DoS). Read more: 👉 https://tinyurl.com/33fw5wb5 #Security https://t.co/sSHazKwSqa
Post summary
SUSE issues a kernel RT live patch that fixes four critical CVEs, specifically addressing a race condition and an unauthenticated NFS denial‑of‑service vulnerability.
3 of 3 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 11.0 | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 6.16 | - | - |