Executive brief
The Linux kernel's futex (fast userspace mutex) implementation had a race condition in its priority inheritance mechanism. A malicious process could exploit this to cause a use-after-free condition when a process from one address space exits, potentially leading to privilege escalation or denial of service. This affects the core synchronization primitives used by many applications.
Technical details
The vulnerability is a use-after-free race condition in the futex priority inheritance (pi) code. A private futex key holds a pointer to the waiter's mm (memory management structure) without taking a reference count. The attach_to_pi_owner() function incorrectly allowed an owner from a different address space to be attached to a private futex. When the owner exited, exit_pi_state_list() would access the waiter's private hash table, but if the waiter's mm was freed concurrently by futex_hash_free(), the owner's cleanup would dereference freed memory. The fix adds validation in attach_to_pi_owner() to reject private futexes whose owner and waiter are in different address spaces. Attack vector is local; the vulnerability requires ability to create and manipulate futex objects.
Affected products
- Linux Linux kernel Versions prior to fix commit 59b3732f95dda1fbd2234514d35f4fb6b5bb6d85 (affects 2.6.11 through 7.x series)
Timeline
- 2026-09-04: disclosed: Published on NVD
- 2026-08-27: patched: Fix committed to stable kernel trees (commit 59b3732f95dda1fbd2234514d35f4fb6b5bb6d85)
- 2026-08-25: other: Fix authored by Kyle Zeng