The Linux kernel futex subsystem had a vulnerability (CVE-2026-31554) where sys_futex_requeue() allowed use-after-free conditions if called with different flags. This was possible because the kernel did not enforce identical flags for the requeue operation, unlike the older sys_futex() calls. The vulnerability was reported by Nicholas and fixed by mandating identical flags for sys_futex_requeue(). The issue affects linux-hwe-edge kernel versions prior to 6.8.x. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) with local attack vector, low complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability. The vendor advisory from Ubuntu confirms a patch is available and recommends updating to fixed kernel versions and rebooting the system. The update also requires recompilation of third-party kernel modules due to ABI changes.

Successful exploitation of this vulnerability could allow a local attacker with low privileges to cause a use-after-free condition in the kernel, potentially leading to privilege escalation, data corruption, or system crashes. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability of the affected system.

A patch is available from the vendor. Users should apply the official Linux kernel updates for linux-hwe-edge to versions 6.8.0 or later as specified by Ubuntu security notices USN-8567-1 and USN-8574-1. After updating, a system reboot is required to apply the changes. Due to an ABI change, all third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions carefully to ensure full remediation.