SB2026100806 - Improper initialization in Linux kernel need_futex_hash_allocate_default() in kernel/fork.c

Description

This security bulletin contains information about 1 vulnerability.

1) Improper initialization (CVE-ID: CVE-2026-98281)

CWE-ID: CWE-665 - Improper Initialization

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.

The vulnerability exists due to improper initialization of the private futex hash in need_futex_hash_allocate_default() in kernel/fork.c when creating a vfork() child that shares its parent's memory address space. A local user can access the shared memory address space through vfork() with private futex waiters present before private hash allocation to compromise system confidentiality, integrity, and availability.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7
• https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5
• https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b