CVE-2026-98281

futex: Also allocate private hash on vfork()

State: Published
Severity: 7.8 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

futex: Also allocate private hash on vfork()

As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user.

Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1dcd36420af2da5bd59306dba9caf78e3d248b1d to before 5468a4855b63b30156a79e5248e01bf1a2c18dd7Affected ee9dce44362b2d8132c32964656ab6dff7dfbc6a to before eecbafa8cabbc4d1482f6a5e2acc25a8f934681bAffected ee9dce44362b2d8132c32964656ab6dff7dfbc6a to before b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5Affected 974ac49a9a068b0591a59f65c63eb06579a13091Affected 6.18.33 to before 6.18.54Affected 7.0.10 to before 7.1Affected
LinuxLinux	7.1Affected before 7.1Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

1dcd36420af2da5bd59306dba9caf78e3d248b1d to before 5468a4855b63b30156a79e5248e01bf1a2c18dd7Affected
ee9dce44362b2d8132c32964656ab6dff7dfbc6a to before eecbafa8cabbc4d1482f6a5e2acc25a8f934681bAffected
ee9dce44362b2d8132c32964656ab6dff7dfbc6a to before b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5Affected
974ac49a9a068b0591a59f65c63eb06579a13091Affected
6.18.33 to before 6.18.54Affected
7.0.10 to before 7.1Affected

LinuxLinux

7.1Affected
before 7.1Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.