CVE-2026-98281 - Vulnerability Details - OpenCVE

In the Linux kernel, the following vulnerability has been resolved:

futex: Also allocate private hash on vfork()

As Jann demonstrated, it is entirely feasible to access the mm through vfork().
Therefore we need to allocate a private hash on vfork() as well as any other
CLONE_VM user.

Specifically, it must be avoided to have (private) futex waiters before
allocating the private hash.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Vendors	Products
Linux Subscribe	Linux Kernel Subscribe

No data.

No data.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7
https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5
https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b

History

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.
Title		futex: Also allocate private hash on vfork()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7 https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5 https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b

Projects

Sign in to view the affected projects.

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:45:40.719Z

Updated: 2026-10-06T08:45:40.719Z

Reserved: 2026-09-25T10:25:14.335Z

Link: CVE-2026-98281

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:18.040

Modified: 2026-10-06T09:18:18.040

Link: CVE-2026-98281

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98281", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.335Z", "datePublished": "2026-10-06T08:45:40.719Z", "dateUpdated": "2026-10-06T08:45:40.719Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-06T08:45:40.719Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Also allocate private hash on vfork()\n\nAs Jann demonstrated, it is entirely feasible to access the mm through vfork().\nTherefore we need to allocate a private hash on vfork() as well as any other\nCLONE_VM user.\n\nSpecifically, it must be avoided to have (private) futex waiters before\nallocating the private hash."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "1dcd36420af2da5bd59306dba9caf78e3d248b1d", "lessThan": "5468a4855b63b30156a79e5248e01bf1a2c18dd7", "status": "affected", "versionType": "git"}, {"version": "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "lessThan": "eecbafa8cabbc4d1482f6a5e2acc25a8f934681b", "status": "affected", "versionType": "git"}, {"version": "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "lessThan": "b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5", "status": "affected", "versionType": "git"}, {"version": "974ac49a9a068b0591a59f65c63eb06579a13091", "status": "affected", "versionType": "git"}, {"version": "6.18.33", "lessThan": "6.18.54", "status": "affected", "versionType": "semver"}, {"version": "7.0.10", "lessThan": "7.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/fork.c"], "versions": [{"version": "7.1", "status": "affected"}, {"version": "0", "lessThan": "7.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc4", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.33", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.1", "versionEndExcluding": "7.3-rc4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7"}, {"url": "https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b"}, {"url": "https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5"}], "title": "futex: Also allocate private hash on vfork()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5468a4855b63b30156a79e5248e01bf1a2c18dd7", "status": "affected", "version": "1dcd36420af2da5bd59306dba9caf78e3d248b1d", "versionType": "git"}, {"lessThan": "eecbafa8cabbc4d1482f6a5e2acc25a8f934681b", "status": "affected", "version": "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "versionType": "git"}, {"lessThan": "b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5", "status": "affected", "version": "ee9dce44362b2d8132c32964656ab6dff7dfbc6a", "versionType": "git"}, {"status": "affected", "version": "974ac49a9a068b0591a59f65c63eb06579a13091", "versionType": "git"}, {"lessThan": "6.18.54", "status": "affected", "version": "6.18.33", "versionType": "semver"}, {"lessThan": "7.1", "status": "affected", "version": "7.0.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/fork.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.1"}, {"lessThan": "7.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc4", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Also allocate private hash on vfork()\n\nAs Jann demonstrated, it is entirely feasible to access the mm through vfork().\nTherefore we need to allocate a private hash on vfork() as well as any other\nCLONE_VM user.\n\nSpecifically, it must be avoided to have (private) futex waiters before\nallocating the private hash."}], "id": "CVE-2026-98281", "lastModified": "2026-10-06T09:18:18.040", "metrics": {}, "published": "2026-10-06T09:18:18.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5468a4855b63b30156a79e5248e01bf1a2c18dd7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b61b6f95d6722ddbbbd09e689fa41b55fd36f9a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eecbafa8cabbc4d1482f6a5e2acc25a8f934681b"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}