A proof-of-concept (PoC) exploit for CVE-2025-38352 , a critical race condition vulnerability in the Linux kernel, has been published on GitHub
See also: React2Shell vulnerability used to install Linux Backdoors
The flaw, which was discovered earlier this year, affects the implementation of POSIX CPU timers and has already been exploited in limited, targeted attacks against 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel's handle_posix_cpu_timers() function. The issue occurs when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK is disabled — a configuration found in most 32-bit Android kernels, but not on 64-bit systems.
The flaw is due to a race condition that occurs when POSIX CPU timers are activated in zombie processes.
By precisely timing the creation of a zombie process, its detachment from the parent process, and the triggering of the timer deletion, an attacker can cause the kernel to access already freed memory, leading to privilege escalation or code execution in the kernel.
See also: Cross-Platform Malware: How Trojans Exploit Windows, Linux, and Mac Simultaneously
Security researcher Faith, who works at blockchain security firm Zellic, has published “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x.
The exploit was presented in an extensive three-part technical blog series, covering the vulnerability discovery, in-depth analysis, and exploitation techniques. One of the key features of the exploit is that it does not require kernel symbol offsets or specific memory addresses, making it portable across different kernel configurations.
The fix in the upstream Linux kernel (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the issue by preventing timers from being processed in zombie processes.
See also: CyberVolk's new VolkLocker ransomware targets Linux and Windows
Device manufacturers and system administrators should prioritize kernel upgrades to mitigate this critical vulnerability.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
