CVE-2026-98281
Description
A flaw was found in the Linux kernel's Fast Userspace Mutex (futex) subsystem. A local user could trigger this flaw by creating a process using the vfork system call, which shares virtual memory with the parent process without properly initializing a private futex hash table. This issue can cause inconsistent state in futex wait queues, potentially leading to a Denial of Service (DoS) or kernel memory corruption.
Statement
A race and initialization ordering flaw can allow a private futex waiter to exist before the shared mm receives its private futex hash when vfork is used. This may make waiter insertion and later wake or removal operations select inconsistent hash state, potentially leaving tasks blocked and causing a local denial of service. For the CVSS the PR:L is selected because an unprivileged local process context is required to invoke vfork and futex operations. AC:H is selected because reliable triggering appears to depend on reaching a timing window while the shared mm is accessible and before hash allocation completes. The issue is not network reachable. The available change does not establish a UAF, an out of bounds access, an information leak, or an arbitrary write primitive, so the supported impact is availability rather than confidentiality or integrity. The paranoid assessment allows A:H if repeated triggering can reliably stall multiple tasks or a critical local service.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Other
Technical Impact: Varies by Context
When code does not follow the instructions for resource management, it can lead to unexpected behaviors and potentially exploitable states.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
