CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)

CVE-2025-38352 is a Linux kernel race condition in the POSIX CPU timers subsystem. The upstream fix is titled "posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()" — the timer-expiry handler running against a concurrent timer deletion. When an exiting, non-autoreaping task calls handle_posix_cpu_timers() and is reaped by its parent or debugger at the wrong moment, a concurrent posix_cpu_timer_del() can fail to observe the timer->it.cpu.firing condition (because cpu_timer_task_rcu() / lock_task_sighand() fail), leaving deletion to operate on freed state — a use-after-free. NVD classifies it as CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition. The September 2025 Android security bulletin reports it was used in limited, targeted exploitation in the wild; a public proof-of-concept exists.

The value of this record for the vault is that it anchors an abstract failure shape — a periodic sweep acting on an object that another path is tearing down mid-flight — to a concrete, named, exploited CVE with a formal CWE class. That same check-then-act shape is what 2026 AI-agent security researchers have begun naming TOCTOU in a wholly different domain (claim-toctou-named-frame-browser-use-agents), and it is distinct in lineage from the database "lost update" anomaly it superficially resembles (claim-lost-update-p4-distinct-from-toctou).