CVE-2026-80775
Received Received - Intake

Race Condition in Linux Kernel Futex Subsystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation futex_hash_allocate() allocates mm->futex.phash.ref without any locking. Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()") moved the allocation here and assumed that the process has just a single thread at this point. Commit ee9dce44362b ("futex: Drop CLONE_THREAD requirement for private default hash alloc") widened need_futex_hash_allocate_default() to cover any CLONE_VM clone, but left out vfork because the parent is suspended and cannot race. That no longer holds once vfork is nested. If a vfork child calls vfork again and is then killed with SIGKILL, the parent is released from its vfork wait and runs concurrently with the grandchild in the same mm. Neither of them went through futex_hash_allocate_default(). When both call prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) at the same time, each one sees mm->futex.phash.ref as NULL and stores its own percpu counter. Only the last store survives. The counter stored first is no longer reachable from the mm, so the references on it are not seen by __futex_ref_atomic_end(). A private hash that still has references is then considered dead and freed, and a task that still holds one of its buckets writes into freed memory in futex_q_lock(). Store the counter once with cmpxchg() and let the loser free_percpu() its own. The initial reference has to be taken before the store, otherwise another task can install a private hash while the counter is still 0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80775
EUVD
EUVD-2026-71418

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's futex subsystem. It occurs when multiple threads in the same memory space attempt to allocate and initialize a futex hash reference simultaneously without proper locking. The issue arises during nested vfork operations where a child process is killed, allowing the parent and grandchild to run concurrently. This can lead to one thread overwriting the futex hash reference while another thread still holds a reference, causing memory corruption when freed memory is accessed.

Impact Analysis

This vulnerability could allow local attackers to escalate privileges, cause denial of service, or execute arbitrary code on affected Linux systems. It specifically targets the futex mechanism used for thread synchronization, potentially leading to system crashes or unauthorized access if exploited.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel security advisories and apply patches promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80775. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart