CISA confirmed this vulnerability is used in real attacks on 04.09.2025. Remediation deadline for US federal agencies: 25.09.2025.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. Please check with specific vendors for information on patching status. For more information, please see: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff ; https://source.android.com/docs/security/bulletin/2025-09-01 ; https://nvd.nist.gov/vuln/detail/CVE-2025-38352
In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| debian | debian linux | 11.0 | |
| Linux | Linux | 2.6.36 | |
| linux | linux kernel | 2.6.36 – < 5.4.295 |
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 2.6.36 < 5.4.295cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.5 < 5.10.239cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.11 < 5.15.186cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 5.16 < 6.1.142cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.2 < 6.6.94cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.7 < 6.12.34cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 6.13 < 6.15.3cpe:2.3:o:linux:linux_kernel:6.16:rc1:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.