PoC Exploit Released for Use-After-Free Vulnerability in Linux Kernel’s POSIX CPU Timers Implementation

A public proof-of-concept for CVE-2025-38352 — a race-condition use-after-free in the Linux kernel POSIX CPU timers (handle_posix_cpu_timers) — has been released. The PoC demonstrates forcing a thread into a zombie state and deleting a POSIX CPU timer to trigger UAF, producing KASAN/kernel warnings; limited targeted exploitation has been reported and patches are available, so affected systems (notably Linux LTS 6.12.33 and some 32-bit Android kernels) should be updated immediately.