Use-after-free in Linux kernel - CVE-2026-80758

Vulnerability details

The vulnerability allows a local user to access freed kernel memory.

The vulnerability exists due to use-after-free in futex_private_hash_put() when releasing the final reference to a private futex hash. A local user can trigger a race that frees the old hash before the function reads its mm pointer to access freed kernel memory.

The race requires the task releasing the final reference to be preempted before it reads the mm pointer.

Affected software

How to mitigate CVE-2026-80758

External References

• https://git.kernel.org/stable/c/12cd315a7b6a7d7db3f69d98bfe3909275e9451d
• https://git.kernel.org/stable/c/1c7efabfbaf796f11000a46094a69955a01ec6cc
• https://git.kernel.org/stable/c/25408c62ed4ebcd491d0e9e4b4a5b512547512e4
• https://git.kernel.org/stable/c/dba60d26e9dda3e157ad6b0934d4232f6c6904ee

Related Security Bulletins

• Use-after-free in Linux kernel futex