Loading story…
CVE-2025-38352 is an actively exploited Linux kernel race condition in POSIX CPU timer processing. A timing flaw between handle_posix_cpu_timers() and posix_cpu_timer_del() while a task exits can cause a use-after-free, allowing a local low-privileged attacker to crash the host or escalate privileges. Red Hat rates the issue Important with a CVSS v3.1 score of 7.8; no qualifying mitigation is available.
Red Hat released fixes across affected kernel packages, including kernel-rt-4.18.0-553.74.1.rt7.415.el8_10 for Red Hat Enterprise Linux 8 Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments. Organizations should install the applicable updated kernel packages and reboot affected systems promptly, prioritizing hosts where untrusted or low-privileged local access is possible.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Red Hat released RHSA-2025:15662 for the RHEL 10 kernel and RHSA-2025:15660 for RHEL 8.4 Advanced Mission Critical Update Support and Extended Update Support Long-Life Add-On kernels, addressing CVE-2025-38352.
Red Hat released fixes for CVE-2025-38352 through RHSA-2025:15646 for RHEL 7 Extended Lifecycle Support kernel-rt, RHSA-2025:15648 for the RHEL 7 ELS kernel, RHSA-2025:15656 for RHEL 8.2 Advanced Update Support, and RHSA-2025:15647 for RHEL 8.6 Advanced Mission Critical Update Support.
Red Hat released RHSA-2025:15921, fixing CVE-2025-38352 in the RHEL 8 kpatch-patch package.
Red Hat released RHSA-2025:15471 for the RHEL 8 kernel and RHSA-2025:15472 for the RHEL 8 kernel-rt packages, fixing the POSIX CPU timer race condition tracked as CVE-2025-38352. The kernel-rt advisory affected Real Time, Real Time for NFV, and x86_64 Extended Life Cycle 8.10 deployments.
The Linux kernel CVE team assigned CVE-2025-38352 to a POSIX CPU timer race between handle_posix_cpu_timers() and posix_cpu_timer_del(). The upstream fix adds an exit_state check in run_posix_cpu_timers() and was included in stable kernels from 5.4.295 through 6.16-rc2.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
8 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceredhat.com
Open sourcelore.kernel.org
Open sourcecwe.mitre.org
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A critical use-after-free vulnerability, tracked as CVE-2025-38352, has been identified in the Linux kernel's POSIX CPU timer implementation. The flaw arises from a race condition in the `handle_posix_cpu_timers()` function, which can be exploited when a process enters a zombie state and timer structures are prematurely freed while still in use. This vulnerability is particularly impactful on systems with `CONFIG_POSIX_CPU_TIMERS_TASK_WORK` disabled, notably affecting 32-bit Android kernels and Linux LTS 6.12.33. A proof-of-concept (PoC) exploit for CVE-2025-38352 has been publicly released, demonstrating how attackers can leverage the race condition to trigger kernel memory corruption and potentially escalate privileges locally. The exploit involves creating a POSIX CPU timer, forcing a thread into a zombie state, and deleting the timer at a critical moment to induce a use-after-free scenario. Successful exploitation is evidenced by KASAN memory sanitizer warnings, and the vulnerability poses a significant risk for local privilege escalation on affected Linux systems.
Jun 29, 2026
**CVE-2022-2959** is a Linux kernel race condition in the watch queue implementation that can allow a local, low-privileged attacker to escalate privileges or cause a denial of service. Missing synchronization in `pipe_resize_ring()` permits a process resizing a watch-queue pipe through `ioctl(IOC_WATCH_QUEUE_SET_SIZE)` to race with a `keyctl()`-triggered notification, resulting in access to a freed buffer. The flaw is categorized as **CWE-820: Missing Synchronization**, in which concurrent unsynchronized access to shared resources can produce an unexpected state and enable data disclosure, modification, or altered execution logic. Red Hat assigned CVSS 3.1 7.0 (`AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`); RHEL 6–8 are unaffected because they lack general notification queue support, while fixes were issued for affected RHEL 9 `kernel`, `kernel-rt`, and `kpatch-patch` packages.
Aug 26, 2026
Red Hat disclosed and remediated **CVE-2025-10263**, an Important Linux kernel flaw affecting multiple Arm processor families, including Cortex, Neoverse, and C1 lines. The bug stems from a race condition in **TLBI** operations during memory permission changes and can let a low-privileged local attacker write to memory owned by a higher exception level, leading to **kernel privilege escalation**, **information disclosure**, or even **guest-to-hypervisor escape**. Red Hat scored the issue **CVSS 8.4** and linked it to `CWE-266`. Fixes were rolled out across a broad set of Red Hat products, including **RHEL 8, 9, and 10** kernel packages and **OpenShift Container Platform 4.22.6**. Advisories such as **RHSA-2026:51746** for RHEL 9.4 SAP-related variants and **RHSA-2026:55445** for RHEL 10.0 Extended Update Support included CVE-2025-10263 alongside other kernel vulnerabilities, while **RHSA-2026:40764** delivered OpenShift updates covering the same issue. Red Hat said affected systems should be updated promptly and **rebooted** after applying the new kernel packages.
Aug 25, 2026