CVE-2026-52973

Analyzed Analyzed - Analysis Complete

futex Hash Allocation Fix in Linux Kernel

Publication date: 2026-06-24

Last updated on: 2026-07-15

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: futex: Drop CLONE_THREAD requirement for private default hash alloc Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non-concurrency assumptions when doing the mm->futex_ref pcpu allocations, leading to bugs[0] when sharing the mm in other ways; ie: BUG: KASAN: slab-use-after-free in futex_hash_put ... where the +1 bias can end up on a percpu counter that mm->futex_ref no longer points at. Loosen the check to cover any CLONE_VM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and we can't race in the first place: either the parent is suspended and the child runs alone, or mm->futex_ref is already allocated from an earlier CLONE_VM.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-15

Generated

2026-07-15

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-14

NVD

CVE-2026-52973

EUVD

EUVD-2026-38841

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	6.17
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 6.17.1 (inc) to 6.18.33 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
CWE-825	The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's futex subsystem. It arises because the function need_futex_hash_allocate_default() relies on strict pthread semantics by requiring the CLONE_THREAD flag. This assumption breaks when the memory descriptor (mm) is shared in other ways, causing concurrency issues.

Specifically, this leads to a bug such as a slab-use-after-free error detected by KASAN (Kernel Address Sanitizer) in futex_hash_put, where a per-CPU counter can be incorrectly referenced after it has been freed.

The fix loosens the requirement from CLONE_THREAD to any CLONE_VM clone except vfork(), which prevents races and maintains performance on existing paths.

Impact Analysis

This vulnerability can cause kernel bugs such as use-after-free errors, which may lead to system instability or crashes.

Because it involves concurrency and memory management in the kernel, exploitation could potentially lead to denial of service or unpredictable behavior in applications relying on futexes.

Hi! I’m here to help you understand CVE-2026-52973. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70