CyberSecBulletin
CVE-2025-38352Exploited in the wildNVD status: Analyzed

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition

Published Updated By the CyberSecBulletin desk

CVE-2025-38352 is a high-severity time-of-check time-of-use (TOCTOU) race condition vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an attacker with a low-privileged account, without any action from a user. The record lists versions 78a4b8e3795b31dae58762bc091bb0f4f74a2200, c076635b3a42771ace7d276de8dc3bc76ee2ba1b, 2f3daa04a9328220de46f0d5c919a6c0073a9f0b as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. CISA added it to the Known Exploited Vulnerabilities catalogue on September 4, 2025, which means attacks have been observed in the wild.

Patch now

Attackers are already exploiting this vulnerability, according to CISA.

What to do

  1. Update Linux to 78a4b8e3795b31dae58762bc091bb0f4f74a2200 or c076635b3a42771ace7d276de8dc3bc76ee2ba1b or 2f3daa04a9328220de46f0d5c919a6c0073a9f0b or 764a7a5dfda23f69919441f2eac2a83e7db6e5bb, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.4.295 or 5.10.239 or 5.15.186 or 6.1.142, whichever matches your release line, or a later version.
  3. CISA's required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, 78a4b8e3795b31dae58762bc091bb0f4f74a2200; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, c076635b3a42771ace7d276de8dc3bc76ee2ba1b; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, 2f3daa04a9328220de46f0d5c919a6c0073a9f0b; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, 764a7a5dfda23f69919441f2eac2a83e7db6e5bb; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, c29d5318708e67ac13c1b6fc1007d179fb65b4d7; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, 460188bc042a3f40f72d34b9f7fc6ee66b0b757b; 0bdd2ed4138ec04e09b4f8165981efc99e439f55 up to, but not including, f90fff1e152dedf52b932240ebbd670d83330eca; and 1 more ranges78a4b8e3795b31dae58762bc091bb0f4f74a2200, c076635b3a42771ace7d276de8dc3bc76ee2ba1b, 2f3daa04a9328220de46f0d5c919a6c0073a9f0b, 764a7a5dfda23f69919441f2eac2a83e7db6e5bb, 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ff, c29d5318708e67ac13c1b6fc1007d179fb65b4d7
LinuxLinux Kernel2.6.36 up to, but not including, 5.4.295; 5.5 up to, but not including, 5.10.239; 5.11 up to, but not including, 5.15.186; 5.16 up to, but not including, 6.1.142; 6.2 up to, but not including, 6.6.94; 6.7 up to, but not including, 6.12.34; 6.13 up to, but not including, 6.15.3; 6.165.4.295, 5.10.239, 5.15.186, 6.1.142, 6.6.94, 6.12.34
DebianDebian Linux11.0Not stated

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
LocalThe attacker needs local access or must trick a user into running something.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
LowA basic user account is enough.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail. Add the tsk->exit_state check into run_posix_cpu_timers() to fix this. This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Time-of-check Time-of-use (TOCTOU) Race Condition

The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

How developers prevent this class of flaw

  • The most basic advice for TOCTOU vulnerabilities is to not perform a check before the use. This does not resolve the underlying issue of the execution of a function on a resource whose state and identity cannot be assured, but it does help to limit the false sense of security given by the check.
  • When the file being altered is owned by the current user and group, set the effective gid and uid to that of the current user and group when executing this statement.
  • Limit the interleaving of operations on files from multiple processes.

More Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities (CWE-367)

Timeline

  1. CVE record published.
  2. Added to CISA's Known Exploited Vulnerabilities catalogue.
  3. CISA published its SSVC assessment (exploitation: active, automatable: no, technical impact: total).
  4. Deadline for US federal agencies to remediate, set by CISA.
  5. Record last changed materially (score, affected products, status or references).

References

Third-party and government advisories

Technical write-ups (may include proof of concept)

Recent Time-of-check Time-of-use (TOCTOU) Race Condition vulnerabilities

Spotted an error? Tell us.