CVE-2026-98788

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix private hash use-after-free on resize

poll_state_synchronize_rcu(mm->futex.phash.batches) is used by

futex_ref_drop() to check that a grace period has passed since the

current hash was published. This relies on batches referencing a grace

period which started after the hash pointer was assigned.

__futex_pivot_hash() sets mmph->batches before it replaces mmph->hash:

scoped_guard(rcu) {

mmph->batches = get_state_synchronize_rcu();

rcu_assign_pointer(mmph->hash, new);

}

The scoped_guard(rcu) doesn't stop new grace periods from starting, and

if one starts between those two assignments, futex_ref_drop() can move

forward while a reader still holds a pointer to the old hash.

Fix things by setting mmph->batches after assigning mmph->hash. The

scoped_guard(rcu) isn't needed, so let's drop that as well.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References