In the Linux kernel, the following vulnerability has been resolved:
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free().
This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[ 151.415969] Call Trace:
[ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
Fix by adding rcu to __mpol_put().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.18-tools-debuginfoUpgrade perf6.18Upgrade perf6.18-debuginfoUpgrade bpftool6.18-debuginfoUpgrade python3-perf6.18Upgrade python3-perf6.18-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extraUpgrade kernel-livepatch-6.18.25-52.107Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18-develUpgrade kernel6.18-toolsUpgrade kernel6.18Upgrade kernel6.18-headersUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-debuginfo | Jun 9, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 17, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-coreUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-modules-coreUpgrade rtlaUpgrade kernel-debuginfoUpgrade kernel-debug-uki-virtUpgrade kernel-tools-debuginfoUpgrade kernel-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-modules-extra-matchedUpgrade libperfUpgrade kernelUpgrade kernel-coreUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-zfcpdump-debuginfoUpgrade kernel-zfcpdump-develUpgrade python3-perfUpgrade kernel-debug-devel-matchedUpgrade kernel-debug-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-modules-coreUpgrade kernel-debug-develUpgrade kernel-debug-modules-coreUpgrade kernel-devel-matchedUpgrade kernel-modulesUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-modulesUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel-zfcpdump-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-tools-libs-develUpgrade kernel-rt-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-toolsUpgrade kernel-tools-libsUpgrade libperf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-rtUpgrade kernel-uki-virt-addonsUpgrade perf-debuginfoUpgrade perfUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-rt-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade kernel-debug-debuginfoUpgrade kernel-zfcpdump-coreUpgrade rvUpgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade kernel-rt-modules | Aug 10, 2026 | Aug 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub