Loading story…
A critical use-after-free vulnerability, tracked as CVE-2025-38352, has been identified in the Linux kernel's POSIX CPU timer implementation. The flaw arises from a race condition in the handle_posix_cpu_timers() function, which can be exploited when a process enters a zombie state and timer structures are prematurely freed while still in use. This vulnerability is particularly impactful on systems with CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled, notably affecting 32-bit Android kernels and Linux LTS 6.12.33.
A proof-of-concept (PoC) exploit for CVE-2025-38352 has been publicly released, demonstrating how attackers can leverage the race condition to trigger kernel memory corruption and potentially escalate privileges locally. The exploit involves creating a POSIX CPU timer, forcing a thread into a zombie state, and deleting the timer at a critical moment to induce a use-after-free scenario. Successful exploitation is evidenced by KASAN memory sanitizer warnings, and the vulnerability poses a significant risk for local privilege escalation on affected Linux systems.
See real exploitation activity before you spend the cycle.
3 events from the most recent confirmed update back to the earliest known activity.
A public proof-of-concept exploit was released for CVE-2025-38352, demonstrating exploitation of the Linux kernel POSIX timer vulnerability. The disclosure increased the risk of broader abuse and prompted urgent patching recommendations.
Reports indicated that CVE-2025-38352 was being actively exploited in targeted attacks. The flaw particularly raised concern for 32-bit Android devices and systems with CONFIG_POSIX_CPU_TIMERS_TASK_WORK disabled.
Kernel patches were released to address CVE-2025-38352, a race condition use-after-free flaw in the Linux kernel's POSIX CPU timer implementation. The vulnerability can lead to kernel memory corruption and possible privilege escalation on affected systems.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecybersecuritynews.com
Open sourcestreypaws.github.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical race condition vulnerability, CVE-2025-38352, affecting the Linux kernel's POSIX CPU timers implementation has been publicly disclosed, with a proof-of-concept (PoC) exploit named 'Chronomaly' released on GitHub. The vulnerability is a use-after-free flaw in the `handle_posix_cpu_timers()` function, primarily impacting 32-bit Android devices where the `CONFIG_POSIX_CPU_TIMERS_TASK_WORK` flag is disabled. Exploitation allows attackers to achieve privilege escalation or execute arbitrary code in the kernel, and the exploit does not require kernel symbol offsets, making it highly portable across different configurations. The exploit leverages advanced race-window extension and cross-cache allocation techniques, requiring a multi-core system for reliable exploitation, and has been successfully demonstrated on QEMU-virtualized Linux kernels running v5.10.157. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild. Security researchers have provided detailed technical analysis and exploitation steps, highlighting the risk to unpatched systems, especially those running vulnerable 32-bit Android kernels. Organizations are urged to review their Linux kernel configurations and apply patches or mitigations to prevent potential privilege escalation attacks stemming from this flaw.
Jun 29, 2026
**CVE-2025-38352** is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between `handle_posix_cpu_timers()` and `posix_cpu_timer_del()` while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available. Red Hat released fixes across affected kernel packages, including `kernel-rt-4.18.0-553.74.1.rt7.415.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
Aug 26, 2026
**CVE-2021-47321** is a use-after-free flaw in Linux kernel watchdog drivers. During driver removal, affected code used `del_timer()`, which could return while an active timer handler continued running; the handler could then access memory freed with the driver, causing system instability or crashes. The upstream fix replaces it with `del_timer_sync()`, ensuring the handler has finished and cannot reschedule before resources are released. The correction is included in Linux kernel versions 4.4.276, 4.9.276, 4.14.240, 4.19.198, 5.4.134, 5.10.52, 5.12.19, 5.13.4, 5.14, and later stable releases. Red Hat rated the issue Moderate (CVSS 3.1: 4.4) and issued RHEL 8 and RHEL 8.8 Extended Update Support fixes through RHSA-2024:7000, RHSA-2024:7001, and RHSA-2024:8107; RHEL 9 is not affected. Organizations should update affected kernel and kernel-rt packages, as Red Hat identified no practical mitigation.
Aug 26, 2026