CoreCVE
Back

HIGH KEV

posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()

Published Jul 22, 2025 ·Due Sep 25, 2025

Description

If an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand().

If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail.

Add the tsk->exit_state check into run_posix_cpu_timers() to fix this.

This fix is not needed if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, because exit_task_work() is called before exit_notify(). But the check still makes sense, task_work_add(&tsk->posix_cputimers_work.work) will fail anyway in this case.

Affected products

Remediation

Red Hat statement

This CVE is rated with Important severity because it may allow an attacker with local user access to escalate their privileges on a target system.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Weaknesses (2)

CWE-362

Race Condition

CWE-367

References (19)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Linux
Published Jul 22, 2025
Updated Sep 8, 2026
Reserved Apr 16, 2025
Link CVE-2025-38352

CISA Vulnrichment

Updated Sep 5, 2025

NVD

Status Analyzed
Modified Sep 8, 2026
Link CVE-2025-38352

Red Hat

Severity Moderate
Public date Jul 22, 2025
Bugzilla 2382581
Link CVE-2025-38352

ENISA EUVD

Assigner Linux
Published Jul 22, 2025
Updated Sep 8, 2026
Exploited since Sep 4, 2025
Link EUVD-2025-22297

GitHub

No data