CVE-2026-98281futex: Also allocate private hash on vfork()
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.14%, higher than 3% of scored CVEs.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.14% (percentile 3)
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1dcd36420af2da5bd59306dba9caf78e3d248b1d before 5468a4855b63b30156a79e5248e01bf1a2c18dd7; from ee9dce44362b2d8132c32964656ab6dff7dfbc6a before eecbafa8cabbc4d1482f6a5e2acc25a8f934681b; from ee9dce44362b2d8132c32964656ab6dff7dfbc6a before b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5; 974ac49a9a068b0591a59f65c63eb06579a13091; from 6.18.33 before 6.18.54; from 7.0.10 before 7.1 | CNA record |
References
- https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7
- https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b
- https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.