CVE-2026-98788

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98788", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.370Z", "datePublished": "2026-10-18T15:48:24.833Z", "dateUpdated": "2026-10-19T09:25:41.209Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:25:41.209Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix private hash use-after-free on resize\n\npoll_state_synchronize_rcu(mm->futex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace\nperiod which started after the hash pointer was assigned.\n\n__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:\n\n scoped_guard(rcu) {\n mmph->batches = get_state_synchronize_rcu();\n rcu_assign_pointer(mmph->hash, new);\n }\n\nThe scoped_guard(rcu) doesn't stop new grace periods from starting, and\nif one starts between those two assignments, futex_ref_drop() can move\nforward while a reader still holds a pointer to the old hash.\n\nFix things by setting mmph->batches after assigning mmph->hash. The\nscoped_guard(rcu) isn't needed, so let's drop that as well."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/futex/core.c"], "versions": [{"version": "56180dd20c19e5b0fa34822997a9ac66b517e7b3", "lessThan": "5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af", "status": "affected", "versionType": "git"}, {"version": "56180dd20c19e5b0fa34822997a9ac66b517e7b3", "lessThan": "f35e3b5784221654f9cdbd6222275a7fa203f6c3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/futex/core.c"], "versions": [{"version": "6.17", "status": "affected"}, {"version": "0", "lessThan": "6.17", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af"}, {"url": "https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}], "title": "futex: Fix private hash use-after-free on resize", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/futex/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af", "status": "affected", "version": "56180dd20c19e5b0fa34822997a9ac66b517e7b3", "versionType": "git"}, {"lessThan": "f35e3b5784221654f9cdbd6222275a7fa203f6c3", "status": "affected", "version": "56180dd20c19e5b0fa34822997a9ac66b517e7b3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/futex/core.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.17"}, {"lessThan": "6.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix private hash use-after-free on resize\n\npoll_state_synchronize_rcu(mm->futex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace\nperiod which started after the hash pointer was assigned.\n\n__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:\n\n scoped_guard(rcu) {\n mmph->batches = get_state_synchronize_rcu();\n rcu_assign_pointer(mmph->hash, new);\n }\n\nThe scoped_guard(rcu) doesn't stop new grace periods from starting, and\nif one starts between those two assignments, futex_ref_drop() can move\nforward while a reader still holds a pointer to the old hash.\n\nFix things by setting mmph->batches after assigning mmph->hash. The\nscoped_guard(rcu) isn't needed, so let's drop that as well."}], "id": "CVE-2026-98788", "lastModified": "2026-10-19T10:19:42.873", "metrics": {}, "published": "2026-10-18T16:17:32.787", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Privilege escalation via use-after-free during futex hash resizing", "id": "2555186", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555186"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nfutex: Fix private hash use-after-free on resize\npoll_state_synchronize_rcu(mm->futex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace\nperiod which started after the hash pointer was assigned.\n__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:\nscoped_guard(rcu) {\nmmph->batches = get_state_synchronize_rcu();\nrcu_assign_pointer(mmph->hash, new);\n}\nThe scoped_guard(rcu) doesn't stop new grace periods from starting, and\nif one starts between those two assignments, futex_ref_drop() can move\nforward while a reader still holds a pointer to the old hash.\nFix things by setting mmph->batches after assigning mmph->hash. The\nscoped_guard(rcu) isn't needed, so let's drop that as well.", "A flaw was found in the Linux kernel's futex (fast userspace mutex) subsystem. When resizing a private hash table, improper synchronization allows the old table memory to be released while another thread is still referencing it. A local attacker could exploit this race condition to trigger a use-after-free memory error, potentially resulting in privilege escalation or a denial of service (DoS) caused by a system crash."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2026-98788", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}], "public_date": "2026-10-18T15:48:24Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98788\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98788\nhttps://git.kernel.org/stable/c/5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af\nhttps://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3\nhttps://kernelcve.org/list/?q=CVE-2026-98788"], "statement": "A race in private futex hash resizing can cause a use-after-free because the recorded RCU grace period may start before the new hash pointer is published. futex_ref_drop() may then conclude that the old hash is no longer used and allow it to be freed while a concurrent reader still holds a pointer to it. A local process using private futex operations may be able to trigger the vulnerable resize and race without administrative capabilities. For the CVSS the PR:L reflects that local user code execution is required but elevated system privileges are not normally required. AC:H applies because successful triggering depends on an RCU timing window during hash replacement and reference release. Impact is at least a local denial of service through a kernel crash. In the worst defensible case the confirmed use-after-free may permit broader memory corruption and privilege escalation if the released hash memory can be reused in a controllable way. The issue is not directly network reachable.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[56180dd20c19e5b0fa34822997a9ac66b517e7b3,5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[56180dd20c19e5b0fa34822997a9ac66b517e7b3,f35e3b5784221654f9cdbd6222275a7fa203f6c3)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T20:45:06.495786+00:00", "updated": "2026-10-22T21:15:12.489854+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}