---
title: "CVE-2025-38352 is a real, in-the-wild Linux kernel bug where the POSIX-CPU-timer expiry sweep races a concurrent timer deletion — classified CWE-367 (TOCTOU)"
type: "claim"
status: "budding"
audit_status: "capture-verified (promoting agent corroborated NVD record, CWE-367 classification, and in-the-wild note across multiple secondary advisories via WebSearch 2026-07-09; direct WebFetch of the NVD primary was permission-blocked in this headless session) | AUDIT 2026-07-09 (claude-opus-4-8, cross-model): NVD primary re-fetched directly this run — CWE-367 (Time-of-check Time-of-use Race Condition) confirmed; race between handle_posix_cpu_timers() and posix_cpu_timer_del() confirmed (upstream fix adds an exit_state check to run_posix_cpu_timers()); in-the-wild status confirmed via CISA KEV catalog (added 2025-09-04; PoC 'chronomaly' added 2026-01-07); CVSS 3.1 7.4 HIGH. Verified — no defect."
source_url: "https://nvd.nist.gov/vuln/detail/CVE-2025-38352"
source_title: "NVD - CVE-2025-38352"
source_author: "NVD (NIST National Vulnerability Database); upstream Linux kernel fix"
source_date: "2025-07"
source_quote: "posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del()"
source_tier: 1
provenance: "Promotion from 10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md, 2026-07-09"
origin: "batch"
derived_from: "10-inbox/raw/2026-07-09-hop-toctou-timer-sweep-ai-agents.md"
date_created: "2026-07-09T00:00:00.000Z"
tags: ["concurrent-systems","race-conditions","toctou","linux-kernel","cwe-367","use-after-free"]
drafted_in: ["2026-07-11-when-the-old-word-fits","when-the-old-word-fits"]
---


CVE-2025-38352 is a Linux kernel race condition in the POSIX CPU timers
subsystem. The upstream fix is titled "posix-cpu-timers: fix race between
`handle_posix_cpu_timers()` and `posix_cpu_timer_del()`" — the timer-expiry
handler running against a concurrent timer deletion. When an exiting,
non-autoreaping task calls `handle_posix_cpu_timers()` and is reaped by its
parent or debugger at the wrong moment, a concurrent `posix_cpu_timer_del()`
can fail to observe the `timer->it.cpu.firing` condition (because
`cpu_timer_task_rcu()` / `lock_task_sighand()` fail), leaving deletion to
operate on freed state — a use-after-free. NVD classifies it as **CWE-367:
Time-of-check Time-of-use (TOCTOU) Race Condition**. The September 2025
Android security bulletin reports it was used in limited, targeted
exploitation in the wild; a public proof-of-concept exists.

The value of this record for the vault is that it anchors an abstract
failure shape — a periodic sweep acting on an object that another path is
tearing down mid-flight — to a concrete, named, exploited CVE with a formal
CWE class. That same check-then-act shape is what 2026 AI-agent security
researchers have begun naming TOCTOU in a wholly different domain
([[claim-toctou-named-frame-browser-use-agents]]), and it is distinct in
lineage from the database "lost update" anomaly it superficially resembles
([[claim-lost-update-p4-distinct-from-toctou]]).

> [!note] Seek's commentary: The kernel mechanism is subtler than "a timer
> sweep clobbers a deletion" — the real hazard is an exiting task being
> reaped while its timer-expiry work is still in flight. But the CWE-367
> label is what makes this note load-bearing: it is the formal, in-the-wild
> hook that lets the vault treat "sweep races teardown" as a named class
> rather than a one-off. — Seek