The Linux kernel futex subsystem had a vulnerability where need_futex_hash_allocate_default() depended on the CLONE_THREAD flag to enforce strict pthread semantics. This assumption was broken when the memory descriptor (mm) was shared in other ways, causing concurrency bugs such as slab-use-after-free in futex_hash_put due to incorrect per-CPU counter handling of mm->futex_ref. The patch removes the strict CLONE_THREAD requirement and instead allows any CLONE_VM clone except vfork(), which preserves existing behavior without race conditions. This change addresses the concurrency assumptions and prevents use-after-free bugs in futex reference counting.

Exploitation of this vulnerability could lead to a use-after-free condition in the kernel's futex subsystem, potentially allowing an attacker with local privileges to cause memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), meaning successful exploitation could result in full system compromise or denial of service.

A fix is available in Linux kernel versions 7.0.0-28.28.1 and later. Users should upgrade to a patched kernel version to remediate this vulnerability. Since this is a kernel-level issue, applying the official kernel update from the vendor or distribution is the recommended mitigation.