Executive brief
A vulnerability in the Linux kernel's futex (fast userspace mutex) system could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue stems from how the kernel manages memory when processes share resources in specific ways, leading to a 'use-after-free' condition. This could impact the stability and availability of affected Linux systems.
Technical details
A use-after-free vulnerability exists in the Linux kernel futex implementation within kernel/fork.c. The function need_futex_hash_allocate_default() incorrectly relied on CLONE_THREAD flags to manage private hash allocations. When memory management (mm) structures are shared via CLONE_VM without CLONE_THREAD (excluding vfork), it breaks non-concurrency assumptions during mm->futex_ref per-CPU allocations. This leads to a slab-use-after-free in futex_hash_put because reference counters may point to deallocated memory. An attacker with local access could exploit this to cause a kernel panic or achieve local privilege escalation. The issue is resolved by loosening the allocation check to cover all CLONE_VM instances except vfork.
Affected products
- Linux Linux 6.17 to 6.18.33, 7.0 to 7.0.10
Timeline
- 2026-05-01: disclosed: Initial patch authored
- 2026-06-24: advisory: CVE published and NVD record created