Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: futex: Fix race on the initial mm->futex.phash.ref allocation… (CVE-2026-80775)

The vulnerability involves a race on the initial allocation of mm->futex.phash.ref in the Linux kernel futex subsystem. The function futex_hash_allocate() allocates this reference without locking, assuming a single-threaded process context. However, nested vfork scenarios allow concurrent execution of parent and grandchild processes sharing the same memory, bypassing the expected allocation path. Concurrent calls to prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) can cause multiple percpu counters to be stored, with only the last surviving. This leads to references on the first counter being lost, causing it to be freed while still in use, resulting in use-after-free conditions during futex queue locking. The fix involves using atomic compare-and-exchange operations to ensure only one counter is stored and the others are properly freed, preventing the race and memory corruption.

This vulnerability can cause use-after-free memory corruption in the Linux kernel futex subsystem, potentially leading to kernel crashes or instability. There is no information about active exploitation in the wild. The impact is primarily on system stability and security due to unsafe concurrent memory access in specific nested vfork scenarios.

A fix for this race condition has been implemented in the Linux kernel. Since no explicit patch links or vendor advisories are provided, users should apply the latest Linux kernel updates that include this fix. Patch status is not yet confirmed from vendor advisories; check official Linux kernel release notes or security advisories for the specific fix. Until patched, avoid nested vfork usage patterns that could trigger this race condition.