Racing the Zombie: PoC Released for Linux Kernel POSIX Timer Vulnerability (CVE-2025-38352)

According to CVE Watchtower, a vulnerability in the Linux kernel’s implementation of POSIX CPU timers has drawn attention after a working PoC exploit was released for CVE-2025-38352. The flaw is a classic use-after-free issue in handle_posix_cpu_timers() that arises from a race between task cleanup in zombie state and timer removal, which can lead the kernel to dereference memory that has already been released.

In the exploit, an auxiliary thread with an active timer fires as the thread becomes a zombie while the parent process removes the timer with ptrace, potentially forcing the kernel to access freed memory and corrupt internal data structures. The researchers note the issue affects 32-bit Android devices based on ARM, while 64-bit kernels with CONFIG_POSIX_CPU_TIMERS_TASK_WORK enabled are protected; practical exploitation is thus limited to certain Android configurations lacking that safeguard.

Reproducing the PoC requires a Linux kernel 6.12.33, a multiprocessor setup, and disabling KASAN memory error detection, with patches already released by kernel developers to mitigate the risk.