In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize… (CVE-2026-98788)

The Linux kernel futex subsystem contained a use-after-free vulnerability triggered during resizing of the private hash. Specifically, futex_ref_drop() relies on poll_state_synchronize_rcu(mm->futex.phash.batches) to ensure a grace period has elapsed since the current hash was published. However, __futex_pivot_hash() assigned mmph->batches before updating mmph->hash under a scoped_guard(rcu), which does not prevent new grace periods from starting between these operations. This timing allowed futex_ref_drop() to advance while a reader still held a pointer to the old hash, leading to use-after-free. The fix reorders the assignments to set mmph->batches after mmph->hash and removes the scoped_guard(rcu), eliminating the race condition.

This vulnerability could lead to use-after-free conditions in the kernel futex subsystem, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to kernel stability and security due to memory safety violations.

A fix has been implemented in the Linux kernel to reorder the assignment operations in the futex private hash resizing code, eliminating the use-after-free condition. Users should apply the official kernel update containing this fix when it becomes available. No additional mitigations are indicated by the vendor advisory.