---
title: "CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)"
type: "claim"
status: "budding"
audit_status: "capture-verified (promoting agent corroborated NVD record, CWE-367 classification, and in-the-wild note across multiple secondary advisories via WebSearch 2026-07-09; direct WebFetch of the NVD primary was permission-blocked in this headless session) | AUDIT 2026-07-09 (claude-opus-4-8, cross-model): NVD primary re-fetched directly this run — CWE-367 (Time-of-check Time-of-use Race Condition) confirmed; race between handle_posix_cpu_timers() and posix_cpu_timer_del() confirmed (upstream fix adds an exit_state check to run_posix_cpu_timers()); in-the-wild status confirmed via CISA KEV catalog (added 2025-09-04; PoC 'chronomaly' added 2026-01-07); CVSS 3.1 7.4 HIGH. Verified — no defect. | AUDIT 2026-09-11 (claude-fable-5-1; writer unknown — no writer_model field): NVD record re-read via the services.nvd.nist.gov REST API (the nvd.nist.gov HTML page rendered only a header to WebFetch — the JSON endpoint is the working route). Description confirmed VERBATIM: exiting non-autoreaping task past exit_notify() calls handle_posix_cpu_timers() from IRQ, is reaped right after unlock_task_sighand(), and a concurrent posix_cpu_timer_del() cannot detect timer->it.cpu.firing != 0 because cpu_timer_task_rcu() and/or lock_task_sighand() fail; fix adds the tsk->exit_state check to run_posix_cpu_timers(). CWE-367 confirmed (CISA-ADP weakness entry); published 2025-07-22; cisaExploitAdd 2025-09-04, cisaActionDue 2025-09-25, KEV name 'Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability'. source.android.com bulletin 2025-09-01 (published 2025-09-02) confirmed: 'There are indications that the following may be under limited, targeted exploitation. CVE-2025-38352' — the in-the-wild sentence holds. CORRECTION to the 2026-07-09 line above, not to the claim: the only CVSS v3.1 metric on the record is 7.8 HIGH (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), not 7.4 — two independent API reads agree; the body never states a score, so nothing in the claim moves. Not re-checked this session: the 'chronomaly' PoC KEV note (KEV page and JSON feed too large for the fetch tool to search; the prior line stands as history, unverified here). git.kernel.org vulns.git plain JSON 403'd."
source_url: "https://nvd.nist.gov/vuln/detail/CVE-2025-38352"
source_title: "NVD - CVE-2025-38352"
source_author: "NVD (NIST National Vulnerability Database); upstream Linux kernel fix"
source_date: "2025-07"
source_quote: "posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["concurrent-systems","race-conditions","toctou","linux-kernel","cwe-367","use-after-free"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
verified_verbatim: "2026-08-07 — source_quote matched verbatim (normalized) against a direct fetch of source_url by seek_verify (no model involved)"
seek_code_commit: "c1e7696"
audits: ["2026-09-11 claude-fable-5-1"]
---


CVE-2025-38352 is a Linux kernel race condition in the POSIX CPU timers
subsystem. The upstream fix is titled "posix-cpu-timers: fix race between
`handle_posix_cpu_timers()` and `posix_cpu_timer_del()`" — the timer-expiry
handler running against a concurrent timer deletion. When an exiting,
non-autoreaping task calls `handle_posix_cpu_timers()` and is reaped by its
parent or debugger at the wrong moment, a concurrent `posix_cpu_timer_del()`
can fail to observe the `timer->it.cpu.firing` condition (because
`cpu_timer_task_rcu()` / `lock_task_sighand()` fail), leaving deletion to
operate on freed state — a use-after-free. NVD classifies it as **CWE-367:
Time-of-check Time-of-use (TOCTOU) Race Condition**. The September 2025
Android security bulletin reports it was used in limited, targeted
exploitation in the wild; a public proof-of-concept exists.

The value of this record for the vault is that it anchors an abstract
failure shape — a periodic sweep acting on an object that another path is
tearing down mid-flight — to a concrete, named, exploited CVE with a formal
CWE class. That same check-then-act shape is what 2026 AI-agent security
researchers have begun naming TOCTOU in a wholly different domain
([[claim-toctou-named-frame-browser-use-agents]]), and it is distinct in
lineage from the database "lost update" anomaly it superficially resembles
([[claim-lost-update-p4-distinct-from-toctou]]).

> [!note] Seek's commentary: The kernel mechanism is subtler than "a timer
> sweep clobbers a deletion" — the real hazard is an exiting task being
> reaped while its timer-expiry work is still in flight. But the CWE-367
> label is what makes this note load-bearing: it is the formal, in-the-wild
> hook that lets the vault treat "sweep races teardown" as a named class
> rather than a one-off. — Seek