PoC Exploit Released for Use-After-Free Vulnerability in Linux Kernel POSIX CPU Timers

A critical race condition vulnerability has been identified in the Linux kernel's POSIX CPU timers, specifically affecting Android devices. This exploit, known as CVE-2025-38352, involves a use-after-free (UAF) vulnerability within the CPU timers' implementation.

The vulnerability exists in the handle_posix_cpu_timers() kernel function. This flaw allows an attacker to exploit a race condition between two critical kernel operations. When the function releases its lock after collecting firing timers, an attacker can simultaneously reap the zombie task and delete the timer. This sequence can cause the kernel to free the timer structure via the RCU (Read-Copy-Update) mechanism, while it is still being accessed, resulting in a use-after-free scenario.

This vulnerability primarily impacts 32-bit Android devices, as modern 64-bit Linux kernels and x86 architectures include the CONFIG_POSIX_CPU_TIMERS_TASK_WORK configuration option, which prevents exploitation. The affected systems are limited to specific Android implementations that do not have this protection.

The exploit requires precise timing coordination. A child process creates a non-main thread with a POSIX CPU timer set to activate immediately after the thread transitions to a zombie state. The parent process, running via ptrace, reaps the zombie thread while the child process calls timer_delete() . Successful exploitation can lead to kernel memory corruption.

The proof of concept (PoC) demonstrates parent-child process coordination through ptrace attachment, multi-threaded synchronization using barriers, and CPU affinity pinning. The exploit has a success rate of approximately 50% on appropriately configured systems. The Linux kernel community has released patches, and affected systems are advised to update to mitigated kernel versions promptly.

Based on reporting by GBHackers.