CVE-2025-38352

CVE-2025-38352 is a race condition in the Linux kernel's POSIX CPU timer subsystem that can trigger a use-after-free of the task's sighand struct. The bug lives in run_posix_cpu_timers(), which runs in IRQ context and can fire while a task is between exit_notify() and actual reaping — the task appears alive enough to hold timers, but its sighand is being freed. The fix adds a check for tsk->exit_state in run_posix_cpu_timers() to detect this liminal state and return early. This is correct but symptomatic: it patches the symptom rather than resolving the architectural mismatch between the timer subsystem's notion of task liveness and the exit path's actual state transitions. If your kernel has CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, you're protected by structural ordering — exit_task_work() runs before exit_notify(), eliminating the window. Check your kernel config. This option was introduced as a safer path but left as non-default, meaning many production kernels still carry the race. What to do: prioritize kernel updates that include the fix. If you cannot patch immediately, the practical risk is lower than CVSS suggests — exploitation requires precise timing orchestration from another task. However, this is exactly the class of bug that becomes dangerous in containerized environments where attackers can influence task scheduling. Monitor for unexpected timer behavior or kernel oopses involving posix_cpu_timer_* functions, particularly during process exit. The deeper concern: this is one instance of a recurring pattern where kernel subsystems derive their own informal definitions of 'task is alive' that don't contract with the exit state machine. Expect similar races in other timer or signal-adjacent paths until the kernel establishes a formal liveness protocol.

Reviewed through automated stages and approved by a human before publication.