Linux Kernel up to 7.2.9/7.3-rc5 futex __futex_pivot_hash use after free

Summaryinfo

A vulnerability was found in Linux Kernel up to 7.2.9/7.3-rc5. It has been classified as very critical. The affected element is the function __futex_pivot_hash of the component futex. The manipulation leads to use after free. This vulnerability is documented as CVE-2026-98788. The attack needs to be performed locally. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as very critical, has been found in Linux Kernel up to 7.2.9/7.3-rc5. This issue affects the function __futex_pivot_hash of the component futex. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize poll_state_synchronize_rcu(mm->futex.phash.batches) is used by futex_ref_drop() to check that a grace period has passed since the current hash was published. This relies on batches referencing a grace period which started after the hash pointer was assigned. __futex_pivot_hash() sets mmph->batches before it replaces mmph->hash: scoped_guard(rcu) { mmph->batches = get_state_synchronize_rcu(); rcu_assign_pointer(mmph->hash, new); } The scoped_guard(rcu) doesn't stop new grace periods from starting, and if one starts between those two assignments, futex_ref_drop() can move forward while a reader still holds a pointer to the old hash. Fix things by setting mmph->batches after assigning mmph->hash. The scoped_guard(rcu) isn't needed, so let's drop that as well.

The advisory is shared at git.kernel.org. The identification of this vulnerability is CVE-2026-98788 since 09/25/2026. The exploitation is known to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. The price for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/18/2026).

Upgrading to version 7.2.10 or 7.3-rc6 eliminates this vulnerability. Applying the patch 5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af/f35e3b5784221654f9cdbd6222275a7fa203f6c3 is able to eliminate this problem. The best possible mitigation is suggested to be upgrading to the latest version.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 7.2.0
• 7.2.1
• 7.2.2
• 7.2.3
• 7.2.4
• 7.2.5
• 7.2.6
• 7.2.7
• 7.2.8
• 7.2.9
• 7.3-rc1
• 7.3-rc2
• 7.3-rc3
• 7.3-rc4
• 7.3-rc5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion