CVE-2026-98788
Description
A flaw was found in the Linux kernel's futex (fast userspace mutex) subsystem. When resizing a private hash table, improper synchronization allows the old table memory to be released while another thread is still referencing it. A local attacker could exploit this race condition to trigger a use-after-free memory error, potentially resulting in privilege escalation or a denial of service (DoS) caused by a system crash.
Statement
A race in private futex hash resizing can cause a use-after-free because the recorded RCU grace period may start before the new hash pointer is published. futex_ref_drop() may then conclude that the old hash is no longer used and allow it to be freed while a concurrent reader still holds a pointer to it. A local process using private futex operations may be able to trigger the vulnerable resize and race without administrative capabilities. For the CVSS the PR:L reflects that local user code execution is required but elevated system privileges are not normally required. AC:H applies because successful triggering depends on an RCU timing window during hash replacement and reference release. Impact is at least a local denial of service through a kernel crash. In the worst defensible case the confirmed use-after-free may permit broader memory corruption and privilege escalation if the released hash memory can be reused in a controllable way. The issue is not directly network reachable.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 4.7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
