Executive brief
The Linux kernel's futex subsystem contains a race condition in its private hash management code that can lead to reading freed memory. When a task releases the final reference to a futex private hash, it may be preempted and another task could free the old hash table. Upon resumption, the first task reads from the freed memory, causing a crash or potential kernel information leak.
Technical details
The vulnerability is a use-after-free race condition in futex_private_hash_put() (kernel/futex/core.c). The root cause: the function drops a reference to the futex private hash (fph) before reading fph->mm for wake_up_var(), and futex_ref_put() re-enables preemption. If that put drops the final reference and the task is preempted, another task can pivot to a replacement hash and free the old one via RCU. When the first task resumes, it accesses fph->mm from freed memory. KASAN detects this as a slab-use-after-free at offset 24 in a freed kmalloc-512 allocation. The fix is to load and cache the mm pointer before dropping the reference, then pass the cached value to wake_up_var(). A patch is available in upstream Linux kernel commit 1c7efabfbaf796f11000a46094a69955a01ec6cc and has been backported to stable branches.
Affected products
- Linux Linux kernel Linux 6.8 and later (introduced by commit bd54df5ea7ca)
Timeline
- 2026-09-04: disclosed: CVE-2026-80758 published
- 2026-08-04: patched: Upstream patch merged (commit 1c7efabfbaf796f11000a46094a69955a01ec6cc)
- 2026-08-27: patched: Backported to stable kernel branches