PoC Exploit Released for Android/Linux Kernel Vulnerability CVE-2025-38352
A proof-of-concept exploit for CVE-2025-38352 , a critical race condition vulnerability in the Linux kernel, has been released on GitHub. This vulnerability affects the POSIX CPU timers implementation and has been exploited in targeted attacks against…
A proof-of-concept exploit for CVE-2025-38352 , a critical race condition vulnerability in the Linux kernel, has been released on GitHub. This vulnerability affects the POSIX CPU timers implementation and has been exploited in targeted attacks against 32-bit Android devices.
CVE-2025-38352 is a use-after-free vulnerability in the Linux kernel's handle_posix_cpu_timers() function, occurring when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK configuration flag is disabled. This setting is common on most 32-bit Android kernels but not on 64-bit systems. The flaw arises from a race condition when POSIX CPU timers trigger on zombie tasks.
By timing the creation of a zombie process, reaping it through a parent process, and triggering timer deletion, attackers can cause the kernel to access freed memory, potentially leading to privilege escalation or kernel code execution.
Security researcher Faith from Zellic has released "Chronomaly," an exploit targeting Linux kernel versions v5.10.x. The exploit is detailed in a three-part technical blog series covering its discovery, analysis, and exploitation techniques.
A proof-of-concept exploit for CVE-2025-38352 , a critical race condition vulnerability in the Linux kernel, has been released on GitHub.
The exploit does not require kernel symbol offsets or specific memory addresses, enhancing its portability across various kernel configurations. It employs advanced race-window extension techniques through CPU timer manipulation and a cross-cache allocation strategy for sigqueue structures. A multi-core system with at least two CPUs is necessary to reliably trigger the race condition.
Successful exploitation has been confirmed on QEMU-virtualized Linux kernels running v5.10.157, with adjustable parameters for different environments. The vulnerability has been included in CISA's Known Exploited Vulnerabilities Catalog , indicating ongoing exploitation.
While the threat primarily affects 32-bit Android devices, the kernel components involved are also present in 32-bit variants of other Linux-based systems. According to the GitHub advisory , users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks. Device manufacturers and system administrators are advised to prioritize kernel updates to mitigate this critical vulnerability.
Based on reporting by Cyber Security News.