Look up another CVE · open CVE-2026-98281 in the interactive tracker
CVE-2026-98281
futex: Also allocate private hash on vfork()
Published 2026-10-06 (13 days ago) by the Linux kernel CNA. Subsystem kernel. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-98281 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.8-1 | Update the kernel and reboot. Fixed in 7.2.8-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
kernel/fork.c
- What this is
- EXEC & BINFMT API, ELFMAINTAINERS section matched on kernel/fork.c · linux-mm@kvack.org · Supported
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-10-06 (13 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 2.7% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- kernel
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.18.33 | 6.18.54 | 5468a4855b63 |
| 7.1 | 7.2.8 | eecbafa8cabb |
| 7.1 | 7.3 | b61b6f95d672 |
| 7.0.10 | 0 | 0 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The trigger is a local process calling vfork()/clone3(CLONE_VM|CLONE_VFORK) in kernel_clone()/copy_process(), where need_futex_hash_allocate_default() skipped the private hash, followed by futex() syscalls on the shared mm. No remote peer supplies any input.
- AC:LAttack complexity, low
- The attacker owns every task involved: the vfork parent (killed through its TASK_KILLABLE wait_for_vfork_done, so its futex exit path runs on the shared mm) and the vfork child, which creates a thread to publish the first private hash. Both sides of the race are under attacker control, so it can be retried at will.
- PR:LPrivileges required, low
- vfork, clone, futex(FUTEX_WAIT/LOCK_PI), robust lists and kill() all work for an ordinary unprivileged user with no capability checks. The hash allocation in futex_hash_allocate_default() has no privilege gate either.
- UI:NUser interaction, none
- The attacker's own processes create the shared-mm state and the futex operations. No other user has to do anything.
- S:UScope, unchanged
- The damaged objects are kernel futex state (mm->futex.phash, hash buckets, pi_state) inside the same kernel security authority. No guest/host or IOMMU boundary is crossed.
- C:HConfidentiality impact, high
- __futex_pivot_hash() leaves waiters queued in the global hash when the private hash is first published, so later PI/requeue operations take a different bucket lock. Futex PI state handled under two different bucket locks is the classic futex use-after-free pattern, and the earlier bug from this same assumption was a KASAN use-after-free, so kernel memory disclosure is plausible.
- I:HIntegrity impact, high
- A freed pi_state or private-hash reference that the attacker can reallocate gives a kernel heap write primitive, as in earlier futex PI use-after-free exploits, so local privilege escalation is possible.
- A:HAvailability impact, high
- Waiters stranded in the global hash miss every later wake that goes to the private bucket, which hangs the affected tasks. The pi_state/reference corruption from inconsistent bucket locking can cause a KASAN splat or kernel oops.