CVE-2025-38352

FAUCET Score

CVE-2025-38352 is a high-severity race condition vulnerability in the Linux kernel's posix-cpu-timers component, affecting Debian and other Linux distributions. This flaw allows a non-autoreaping task to be reaped prematurely, leading to a race condition with posix_cpu_timer_del() that can prevent proper timer detection. With a CVSS score of 7.4, the vulnerability has a high impact on confidentiality, integrity, and availability, and is difficult to exploit locally. Notably, this CVE is actively exploited in the wild, specifically targeting vulnerable Linux kernels v5.10.x, and has garnered significant community discussion and media coverage, including an Android kernel exploit named "Chronomaly" available on GitHub.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 2.6.36, < 5.4.295CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.5, < 5.10.239CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.11, < 5.15.186CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 5.16, < 6.1.142CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::
		>= 6.2, < 6.6.94CPE matchmatch criteria	cpe:2.3:o:linux:linux_kernel::::::::

CVSS Data

CVSS version used by this source: 3.1

7.4HIGH

CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

Exploitability Score

1.4

Impact Score

5.9

CvssVersion

3.1

Exploit Intelligence

EPSS Score

1.34%

Probability of exploitation in next 30 days

EPSS Percentile

68.5%

Percentile rank of EPSS score among Peer Group

As of 2026-07-25

Model: v2026.06.15

Added to KEV · Sep 4, 2025

This CVE's current EPSS score of 0.0135 is in the 95th percentile among its peer group of 157 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (38)

linuxpatch availablevia osv

Product: KernelFixed in: 5.4.295

linuxpatch availablevia osv

Product: KernelFixed in: 5.10.239

linuxpatch availablevia osv

Product: KernelFixed in: 5.15.186

linuxpatch availablevia osv

Product: KernelFixed in: 6.1.142

linuxpatch availablevia osv

Product: KernelFixed in: 6.6.94

linuxpatch availablevia osv

Product: KernelFixed in: 6.12.34

linuxpatch availablevia osv

Product: KernelFixed in: 6.15.3

microsoftpatch availablevia msrc

Product: azl3 kernel 6.6.92.2-2 on Azure Linux 3.0Fixed in: 6.6.96.1-1

microsoftpatch availablevia msrc

Product: 17085-17084Fixed in: 6.6.96.1-1

microsoftpatch availablevia msrc

Product: 19880-17084Fixed in: 6.6.96.1-1

microsoftpatch availablevia msrc

Product: azl3 kernel 6.6.96.1-1 on Azure Linux 3.0Fixed in: 6.6.96.1-1

redhatpatch availablevia redhat_api

Product: Red Hat Enterprise Linux 7 Extended Lifecycle SupportFixed in: kernel-0:3.10.0-1160.139.1.el7

CVE-2025-38352

Impacted Technologies

CVSS Data

Exploit Intelligence

Social Chatter

Media Mentions

Remediation

Vendor Patches (38)

Vendor Advisories (5)

References