"Web search results for query: \"latest Android vulnerabilities 2025\"\n\nLinks: [{\"title\":\"Android Security Bulletin—August 2025 | Android Open Source Project\",\"url\":\"https://source.android.com/docs/security/bulletin/2025-08-01\"},{\"title\":\"Critical Android vulnerabilities patched—update as soon as you can | Malwarebytes\",\"url\":\"https://www.malwarebytes.com/blog/news/2025/08/android-critical-vulnerabilities-patched-update-as-soon-as-you-can\"},{\"title\":\"Android Security Alert: Google Patches 120 Flaws, Including Two Zero-Days Under Attack\",\"url\":\"https://thehackernews.com/2025/09/android-security-alert-google-patches.html\"},{\"title\":\"Android Security Bulletin—March 2025 | Android Open Source Project\",\"url\":\"https://source.android.com/docs/security/bulletin/2025-03-01\"},{\"title\":\"Update your Android! Google patches 111 vulnerabilities, 2 are critical | Malwarebytes\",\"url\":\"https://www.malwarebytes.com/blog/news/2025/09/update-your-android-google-patches-111-vulnerabilities-including-2-critical-flaws\"},{\"title\":\"Android Security Bulletin—May 2025 | Android Open Source Project\",\"url\":\"https://source.android.com/docs/security/bulletin/2025-05-01\"},{\"title\":\"August 2025 Android Security Bulletin: Key Fixes Released\",\"url\":\"https://thecyberexpress.com/august-2025-android-security-bulletin/\"},{\"title\":\"Google's March 2025 Android Security Update Fixes Two Actively Exploited Vulnerabilities\",\"url\":\"https://thehackernews.com/2025/03/googles-march-2025-android-security.html\"},{\"title\":\"Over 30 Vulnerabilities Patched in Android - SecurityWeek\",\"url\":\"https://www.securityweek.com/over-30-vulnerabilities-patched-in-android/\"},{\"title\":\"Google addresses six vulnerabilities in August’s Android security update | CyberScoop\",\"url\":\"https://cyberscoop.com/android-security-update-august-2025/\"}]\n\nBased on the search results, here's a summary of the latest Android vulnerabilities in 2025:\n\n## Recent Security Updates\n\n### September 2025 (Most Recent)\nGoogle addressed 120 security flaws in Android as part of its September 2025 fixes, including two zero-day vulnerabilities that were exploited in targeted attacks.(no content)The bulletin patched 111 vulnerabilities including two critical flaws.\n\n**Notable Exploited Vulnerabilities:**\n- CVE-2025-38352 - A race condition vulnerability in the Linux kernel time subsystem allowing local elevation of privilege\n- CVE-2025-48543 - A vulnerability in Android Runtime that could lead to local escalation of privilege with no additional execution privileges needed\n- CVE-2025-48539 - A critical vulnerability in the System component that could lead to remote (proximal/adjacent) code execution with no user interaction required\n\n### August 2025\nGoogle patched six vulnerabilities in Android, including two critical vulnerabilities in its August 2025 bulletin.\n\n**Critical Vulnerabilities:**\n- CVE-2025-48530 - A vulnerability in the Android System which could lead to remote code execution in combination with other bugs, with no additional execution privileges needed and no user interaction\n- CVE-2025-21479 - Unauthorized command execution in GPU micronode causing memory corruption(no content)CVE-2025-21479 and CVE-2025-27038 were reportedly exploited in the wild before the August security release.\n\n### Earlier 2025 Updates\n- **March 2025**: Google addressed 44 vulnerabilities, including two under active exploitation in the wild\n- **May 2025**: CVE-2025-27363 was under limited, targeted exploitation\n- **June 2025**: Over 30 vulnerabilities were patched, all classified as high severity, with CVE-2025-26443 being the most serious\n\n## Recommendations\nIf your Android phone shows patch level 2025-08-05 or later, the August issues are considered fixed.(no content)For September updates, patch level 2025-09-05 or later indicates the issues are fixed. Users are encouraged to update their devices as soon as updates become available."

"Web search results for query: \"CVE-2025-38352 vulnerable functions technical details code\"\n\nLinks: [{\"title\":\"CVE-2025-38352 - Vulnerability Details - OpenCVE\",\"url\":\"https://app.opencve.io/cve/CVE-2025-38352\"},{\"title\":\"CVE-2025-38352 Impact, Exploitability, and Mitigation Steps | Wiz\",\"url\":\"https://www.wiz.io/vulnerability-database/cve/cve-2025-38352\"},{\"title\":\"September 2025 Android Security Bulletin Highlights Exploited Flaws: CVE-2025-38352 & CVE-2025-48543 - SOCRadar® Cyber Intelligence Inc.\",\"url\":\"https://socradar.io/september-2025-android-security-bulletin-cve-2025-38352-cve-2025-48543/\"},{\"title\":\"NVD - CVE-2025-38352\",\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2025-38352\"},{\"title\":\"Android Security Bulletin – September 2025 Patches Actively Exploited Flaws (CVE-2025-38352 & CVE-2025-48543) and Critical RCE\",\"url\":\"https://securityonline.info/android-security-bulletin-september-2025-patches-actively-exploited-flaws-cve-2025-38352-cve-2025-48543-and-critical-rce/\"},{\"title\":\"CVE-2025-38352\",\"url\":\"https://security-tracker.debian.org/tracker/CVE-2025-38352\"},{\"title\":\"CVE security vulnerability database. Security vulnerabilities, exploits, references and more\",\"url\":\"https://www.cvedetails.com/\"},{\"title\":\"SUSE CVE Database Common Vulnerabilities and Exposures | SUSE\",\"url\":\"https://www.suse.com/security/cve/index.html\"},{\"title\":\"Known Exploited Vulnerabilities Catalog | CISA\",\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog\"},{\"title\":\"Qualys Vulnerability Detection Pipeline Overview\",\"url\":\"https://www.qualys.com/vulnerability-detection-pipeline/\"}]\n\nBased on the search results, here's what I found about CVE-2025-38352:\n\n## Overview\n\nCVE-2025-38352 is a vulnerability discovered in the Linux kernel, specifically related to a race condition between handle_posix_cpu_timers() and posix_cpu_timer_del() functions.(no content)This vulnerability has a CVSS score of 7.4 and could allow an attacker to trigger kernel instability or denial of service under specific timing scenarios.\n\n## Technical Details\n\n### Vulnerable Functions\n\nThe vulnerability involves two key functions in the Linux kernel's POSIX CPU timer implementation:\n- **handle_posix_cpu_timers()**\n- **posix_cpu_timer_del()**\n\n### The Race Condition\n\nIf an exiting non-autoreaping task has already passed exit_notify() and calls handle_posix_cpu_timers() from IRQ, it can be reaped by its parent or debugger right after unlock_task_sighand(). If a concurrent posix_cpu_timer_del() runs at that moment, it won't be able to detect timer->it.cpu.firing != 0: cpu_timer_task_rcu() and/or lock_task_sighand() will fail.\n\n### The Fix\n\nThe issue has been fixed by adding a tsk->exit_state check into run_posix_cpu_timers().(no content)This fix is not required if CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y, as exit_task_work() is called before exit_notify(). However, the check is still implemented as task_work_add(&tsk->posix_cputimers_work.work) would fail in this case anyway.\n\n## Exploitation Status\n\nTwo vulnerabilities, tracked as CVE-2025-38352 and CVE-2025-48543, are already confirmed to be under exploitation.(no content)This CVE is in the KEV database since Sept. 4, 2025.\n\n## Affected Versions\n\nSeveral Linux versions were found to be vulnerable, including Linux 5.10.223-1 in Debian Bullseye, 6.1.137-1 in Bookworm, and 6.12.31-1 in Trixie."