SB20260905172 - Use-after-free in Linux kernel futex

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-80775)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause memory corruption.

The vulnerability exists due to a race condition in futex_hash_allocate() when concurrently allocating the initial mm->futex_ref counter. A local user can concurrently invoke prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) to cause memory corruption.

Exploitation requires a vfork child to invoke vfork again and then be killed with SIGKILL, causing its parent and grandchild to run concurrently while sharing the same memory map.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/86d12b34bafc9a4c271a9edefea88855a934d6e5
• https://git.kernel.org/stable/c/bde0238083647381d4747355c5a19115a3422b96
• https://git.kernel.org/stable/c/c4b4972d8edcdf50b6518f55119e129d2f668a10
• https://git.kernel.org/stable/c/ff252ed45c8263525f2f54d81c5fa6d547fba344