Researcher Details Zero-Day Linux/Android Kernel Flaw (CVE-2025-38352)

SecurityOnline[.]info reports a TOCTOU race condition in the Linux/Android kernel’s POSIX CPU Timer subsystem, CVE-2025-38352, arising from improper synchronization in kernel/time/posix-cpu-timers.c. According to Android Security Bulletin, the flaw was disclosed in the September 2025 edition and is suspected of being under limited, targeted exploitation.

The analysis by Security researcher StreyPaws describes a race window where one thread handles expired timers while another deletes them, potentially enabling use-after-free conditions, memory corruption, or system crashes and even privilege escalation on vulnerable systems. Tests with an Android kernel emulation environment demonstrated a crash despite configurations intended to reduce risk, underscoring the persistent danger of race conditions in timekeeping code.

The patch introduced a safeguard: if (tsk->exit_state) return;, aimed at preventing overlap between timer deletion and expiry processing and strengthening the Linux timekeeping infrastructure.