All vulnerabilities
CVE-2025-38352

Linux Kernel Time-of-Check Time-of-Use (TOCTOU) Race Condition Vulnerability

Linux KernelOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationExploited in the wildAdded to KEV 4 Sep 2025CISA KEV
Exploit odds (EPSS)1.36%Chance of exploitation activity in the next 30 days, higher than 71% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in78a4b8e3795b31dae58762bc091bb0f4f74a2200Also 2f3daa04a9328220de46f0d5c919a6c0073a9f0b, 764a7a5dfda23f69919441f2eac2a83e7db6e5bb and 2 moreCVE List
Federal deadline25 Sep 2025Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 78a4b8e3795b31dae58762bc091bb0f4f74a2200LinuxCVE List
  • 2f3daa04a9328220de46f0d5c919a6c0073a9f0bLinuxCVE List
  • 764a7a5dfda23f69919441f2eac2a83e7db6e5bbLinuxCVE List
  • 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ffLinuxCVE List
  • 460188bc042a3f40f72d34b9f7fc6ee66b0b757bLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 22 Jul 2025, 08:04 UTCPublishedCVE List
  2. 4 Sep 2025Added to CISA KEVCISA KEV

Description

Linux kernel contains a time-of-check time-of-use (TOCTOU) race condition vulnerability that has a high impact on confidentiality, integrity, and availability.

Text from CVE List

Affected versions 18

  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before 78a4b8e3795b31dae58762bc091bb0f4f74a2200CVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before c076635b3a42771ace7d276de8dc3bc76ee2ba1bCVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before 2f3daa04a9328220de46f0d5c919a6c0073a9f0bCVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before 764a7a5dfda23f69919441f2eac2a83e7db6e5bbCVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before 2c72fe18cc5f9f1750f5bc148cf1c94c29e106ffCVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before c29d5318708e67ac13c1b6fc1007d179fb65b4d7CVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before 460188bc042a3f40f72d34b9f7fc6ee66b0b757bCVE List
  • Linuxaffected: 0bdd2ed4138ec04e09b4f8165981efc99e439f55 before f90fff1e152dedf52b932240ebbd670d83330ecaCVE List
  • Linuxaffected: 2.6.36CVE List
  • Linuxunaffected: all versions before 2.6.36CVE List
  • Linuxunaffected: 5.4.295 through 5.4.*CVE List
  • Linuxunaffected: 5.10.239 through 5.10.*CVE List
  • Linuxunaffected: 5.15.186 through 5.15.*CVE List
  • Linuxunaffected: 6.1.142 through 6.1.*CVE List
  • Linuxunaffected: 6.6.94 through 6.6.*CVE List
  • Linuxunaffected: 6.12.34 through 6.12.*CVE List
  • Linuxunaffected: 6.15.3 through 6.15.*CVE List
  • Linuxunaffected: 6.16CVE List

References 14