{"id":"CVE-2026-98281","published":"2026-10-06T09:18:18.040","lastModified":"2026-10-07T07:17:07.800","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Also allocate private hash on vfork()\n\nAs Jann demonstrated, it is entirely feasible to access the mm through vfork().\nTherefore we need to allocate a private hash on vfork() as well as any other\nCLONE_VM user.\n\nSpecifically, it must be avoided to have (private) futex waiters before\nallocating the private hash.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7","tags":[]},{"url":"https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5","tags":[]},{"url":"https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel fails to properly allocate private futex hash tables during vfork() operations, which can lead to race conditions where futex waiters are created before the necessary hash table is allocated. This vulnerability allows for potential memory corruption or denial of service when processes fork with shared memory mappings.","exploitability":"Exploitation requires a process that uses vfork() with shared memory mappings and creates futex waiters before the private hash table is allocated, which is moderately difficult to trigger in practice without specific application patterns.","blast_radius":"If exploited, this vulnerability could affect any system running Linux kernels that use vfork() with shared memory, potentially leading to system instability or denial of service across multiple processes.","remediation":"Upgrade to Linux kernel version 6.10 or later which contains the fix for this futex hash allocation issue during vfork() operations.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","memory-corruption","race-condition"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:04:01.749Z"}}