Loading story…
A critical race condition vulnerability, CVE-2025-38352, affecting the Linux kernel's POSIX CPU timers implementation has been publicly disclosed, with a proof-of-concept (PoC) exploit named 'Chronomaly' released on GitHub. The vulnerability is a use-after-free flaw in the handle_posix_cpu_timers() function, primarily impacting 32-bit Android devices where the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled. Exploitation allows attackers to achieve privilege escalation or execute arbitrary code in the kernel, and the exploit does not require kernel symbol offsets, making it highly portable across different configurations. The exploit leverages advanced race-window extension and cross-cache allocation techniques, requiring a multi-core system for reliable exploitation, and has been successfully demonstrated on QEMU-virtualized Linux kernels running v5.10.157.
The vulnerability has been added to CISA’s Known Exploited Vulnerabilities Catalog, indicating active exploitation in the wild. Security researchers have provided detailed technical analysis and exploitation steps, highlighting the risk to unpatched systems, especially those running vulnerable 32-bit Android kernels. Organizations are urged to review their Linux kernel configurations and apply patches or mitigations to prevent potential privilege escalation attacks stemming from this flaw.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2025-38352 to its Known Exploited Vulnerabilities Catalog, reflecting confirmed exploitation and elevating the urgency of remediation. This formalized the vulnerability's status as an actively exploited security issue.
An upstream fix was released to address CVE-2025-38352 in the Linux kernel. Administrators and device makers were advised to update to patched kernels or enable CONFIG_POSIX_CPU_TIMERS_TASK_WORK as a mitigation.
Reports said CVE-2025-38352 was being actively exploited, primarily against 32-bit Android devices, and that the Chronomaly exploit could grant root access on vulnerable Linux kernels. The issue was also noted as potentially affecting other 32-bit Linux-based systems.
Security researcher Faith from Zellic released a working exploit named Chronomaly for CVE-2025-38352. The exploit was described as portable across kernel configurations because it does not require kernel symbol offsets or fixed memory addresses.
A critical use-after-free vulnerability in the Linux kernel's POSIX CPU timers implementation, tracked as CVE-2025-38352, was publicly disclosed. The flaw affects systems where CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled and can enable privilege escalation or kernel code execution.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical use-after-free vulnerability, tracked as CVE-2025-38352, has been identified in the Linux kernel's POSIX CPU timer implementation. The flaw arises from a race condition in the `handle_posix_cpu_timers()` function, which can be exploited when a process enters a zombie state and timer structures are prematurely freed while still in use. This vulnerability is particularly impactful on systems with `CONFIG_POSIX_CPU_TIMERS_TASK_WORK` disabled, notably affecting 32-bit Android kernels and Linux LTS 6.12.33. A proof-of-concept (PoC) exploit for CVE-2025-38352 has been publicly released, demonstrating how attackers can leverage the race condition to trigger kernel memory corruption and potentially escalate privileges locally. The exploit involves creating a POSIX CPU timer, forcing a thread into a zombie state, and deleting the timer at a critical moment to induce a use-after-free scenario. Successful exploitation is evidenced by KASAN memory sanitizer warnings, and the vulnerability poses a significant risk for local privilege escalation on affected Linux systems.
Jun 29, 2026
**CVE-2025-38352** is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between `handle_posix_cpu_timers()` and `posix_cpu_timer_del()` while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available. Red Hat released fixes across affected kernel packages, including `kernel-rt-4.18.0-553.74.1.rt7.415.el8_10` for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
Aug 26, 2026
A **use-after-free race** in the Linux kernel's `epoll` subsystem, tracked as **`CVE-2026-46242`** and dubbed **Bad Epoll**, allows an unprivileged local user to escalate to **root** and may also be reachable from constrained environments including the **Chrome renderer sandbox** and potentially **Android**. The bug was introduced in 2023 in `fs/eventpoll.c`, stems from a race in `ep_remove()` and `ep_remove_file()` during concurrent close operations on related epoll file objects, and was reported by **Jaeyoung Chung** of Seoul National University as a **0-day** submission to Google's **kernelCTF**. Public reporting says the exploit achieves roughly **99% reliability** on some targets despite a narrow race window, making it unusually dangerous for a modern Linux local privilege-escalation flaw. Researchers and vendors said there is **no practical workaround** because `epoll` is a core kernel feature, and fixes were issued through upstream and backported updates including **6.6.144+** and **6.12.95+**, with advisories for distributions such as **Debian trixie, RHEL 9, RHEL 10, and Azure Linux 3**. The disclosures also tied the issue to a broader pattern of advanced exploit discovery in kernel and browser-adjacent code: Google Project Zero previously highlighted renderer-to-kernel exploitation paths using `MSG_OOB`, while Anthropic said its **Mythos Preview** system found a separate epoll race, **`CVE-2026-43074`**, in the same area of code. Maintainers noted that fixing that earlier epoll bug did not eliminate Bad Epoll, underscoring how difficult this code path has been to secure.
Jul 14, 2026