In the Linux kernel, the following vulnerability has been resolved:
futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free().
This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[ 151.415969] Call Trace:
[ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
Fix by adding rcu to __mpol_put().
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade python3-perf6.18Upgrade bpftool6.18-debuginfoUpgrade perf6.18Upgrade python3-perf6.18-debuginfoUpgrade perf6.18-debuginfoUpgrade bpftool6.18Upgrade kernel6.18-tools-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel-livepatch-6.18.25-52.107Upgrade kernel6.18-debuginfo-common-aarch64Upgrade kernel6.18Upgrade kernel6.18-modules-extraUpgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel6.18-develUpgrade kernel6.18-toolsUpgrade kernel6.18-headersUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.18-debuginfo | Jun 9, 2026 | Apr 2, 2026 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Jul 17, 2026 | Apr 2, 2026 |
| Rocky_linux | — | Upgrade kernel-debug-uki-virtUpgrade kernel-zfcpdump-develUpgrade kernel-coreUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-debug-modules-coreUpgrade kernel-debug-devel-matchedUpgrade kernel-rt-debug-develUpgrade kernel-rt-modules-extraUpgrade kernel-tools-debuginfoUpgrade kernel-zfcpdump-modules-coreUpgrade kernel-debuginfoUpgrade kernel-modulesUpgrade kernel-modules-extra-matchedUpgrade kernel-debug-modulesUpgrade kernel-debug-coreUpgrade kernel-debugUpgrade libperfUpgrade python3-perfUpgrade kernel-modules-coreUpgrade kernel-modules-extraUpgrade kernel-rt-coreUpgrade kernel-zfcpdump-debuginfoUpgrade kernelUpgrade kernel-debug-develUpgrade kernel-devel-matchedUpgrade kernel-rt-debug-modulesUpgrade rtlaUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-rt-debug-coreUpgrade kernel-toolsUpgrade python3-perf-debuginfoUpgrade kernel-tools-libsUpgrade kernel-zfcpdump-coreUpgrade kernel-debug-modules-extraUpgrade kernel-zfcpdump-modulesUpgrade rvUpgrade kernel-uki-virtUpgrade kernel-rt-modules-coreUpgrade libperf-debuginfoUpgrade kernel-zfcpdumpUpgrade kernel-rtUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-uki-virt-addonsUpgrade kernel-develUpgrade kernel-zfcpdump-devel-matchedUpgrade kernel-debug-debuginfoUpgrade kernel-debuginfo-common-s390xUpgrade kernel-rt-develUpgrade kernel-tools-libs-develUpgrade kernel-rt-debug-modules-coreUpgrade kernel-rt-modulesUpgrade kernel-rt-debug-modules-extraUpgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade perf-debuginfo | Aug 10, 2026 | Aug 7, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub