InfoSecBulletin Cybersecurity for mankind
A PoC exploit for CVE-2025-38352, a critical race condition flaw in the Linux kernel, is now available on GitHub. A vulnerability found this year affects POSIX CPU timers and had been used in targeted attacks on 32-bit Android devices.
CVE-2025-38352 is a use-after-free (UAF) vulnerability in the Linux kernel’s handle_posix_cpu_timers() function. The flaw arises when the CONFIG_POSIX_CPU_TIMERS_TASK_WORK flag is disabled, which is common in most 32-bit Android kernels but not in 64-bit ones.
Meta’s louisiana data center to exceed 250 billion price tag
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
The vulnerability arises from a race condition that occurs when POSIX CPU timers fire on zombie tasks. Attackers can exploit a zombie process by timing its creation and reaping it via a parent process. This may trigger the kernel to access freed memory, resulting in privilege escalation or kernel code execution.
Chronomaly Exploit:
Security researcher Faith (working at blockchain security firm Zellic) has released “Chronomaly,” a fully functional exploit targeting Linux kernel versions v5.10.x. A three-part blog series detailed the discovery, analysis, and exploitation techniques of the vulnerability.
The exploit is significant because it doesn’t need kernel symbol offsets or specific memory addresses, making it versatile across various kernel setups.
It uses advanced techniques to extend race windows by manipulating CPU timers and allocating cache for sigqueue structures. The exploit needs a multi-core system with at least two CPUs to effectively trigger the race condition.
Testing shows successful exploitation of QEMU-virtualized Linux kernels version 5.10.157, with adjustable parameters for various environments. CISA has added the vulnerability to its Known Exploited Vulnerabilities Catalog, showing it is being actively exploited.
The threat mainly impacts 32-bit Android devices, but the kernel components are also found in 32-bit versions of other Linux-based systems.
According to the GitHub advisory, users should update to a patched kernel or enable the CONFIG_POSIX_CPU_TIMERS_TASK_WORK option.
The upstream Linux kernel patch (commit f90fff1e152dedf52b932240ebbd670d83330eca) addresses the vulnerability by preventing timer processing on zombie tasks.
Device makers and system admins should focus on kernel updates to fix this serious vulnerability.
