{"schema_version":"1.7.5","id":"ASB-A-425282960","published":"2025-09-01T00:00:00Z","modified":"2026-07-24T16:43:26.002557455Z","aliases":["A-425282960","CVE-2025-38352"],"details":"In run_posix_cpu_timers of posix-cpu-timers.c, there is a possible way to trigger a use-after-free on a sigqueue object due to memory corruption. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.","affected":[{"package":{"name":":linux_kernel:","ecosystem":"Android"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":":0"},{"fixed":":2025-09-05"}]}],"versions":["Kernel"],"ecosystem_specific":{"fixes":["https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb","https://android.googlesource.com/kernel/common/+/1bf1aa362e6b9573a310fcd14f35bc875b42ba83"],"severity":"High","spl":"2025-09-05","types":["EoP"],"vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["239550998081870972127451971872312053997","147150368589273284825147366725515272174","82833152002525841078026884179897054603"],"threshold":0.9},"id":"ASB-A-425282960-0d6867e2","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb","target":{"file":"kernel/time/posix-cpu-timers.c"}},{"deprecated":false,"digest":{"line_hashes":["239550998081870972127451971872312053997","147150368589273284825147366725515272174","82833152002525841078026884179897054603"],"threshold":0.9},"id":"ASB-A-425282960-553e0dda","signature_type":"Line","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1bf1aa362e6b9573a310fcd14f35bc875b42ba83","target":{"file":"kernel/time/posix-cpu-timers.c"}},{"deprecated":false,"digest":{"function_hash":"328631927418429210242873994005901180136","length":154},"id":"ASB-A-425282960-d6dfad21","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/1bf1aa362e6b9573a310fcd14f35bc875b42ba83","target":{"file":"kernel/time/posix-cpu-timers.c","function":"run_posix_cpu_timers"}},{"deprecated":false,"digest":{"function_hash":"328631927418429210242873994005901180136","length":154},"id":"ASB-A-425282960-e83512d2","signature_type":"Function","signature_version":"v1","source":"https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb","target":{"file":"kernel/time/posix-cpu-timers.c","function":"run_posix_cpu_timers"}}]},"database_specific":{"source":"https://storage.googleapis.com/android-osv/ASB-A-425282960.json"}}],"references":[{"type":"ADVISORY","url":"https://source.android.com/security/bulletin/2025-09-01"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/157f357d50b5038e5eaad0b2b438f923ac40afeb"},{"type":"FIX","url":"https://android.googlesource.com/kernel/common/+/1bf1aa362e6b9573a310fcd14f35bc875b42ba83"}]}