CVE-2026-23415: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()
In the Linux kernel, the following vulnerability has been resolved:
futex: Fix UaF between futexkeytonodeopt() and vmareplacepolicy()
During futexkeytonodeopt() execution, vma->vmpolicy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vmareplacepolicy() which frees the old mempolicy immediately via kmemcachefree().
This creates a race where futexkeytonode() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode.
[ 151.412631] BUG: KASAN: slab-use-after-free in futexkeytonode (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87
[ 151.415969] Call Trace:
[ 151.416732] asanload2 (mm/kasan/generic.c:271) [ 151.416777] futexkeytonode (kernel/futex/core.c:349) [ 151.416822] getfutexkey (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)
Fix by adding rcu to mpolput().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the futex UaF by adding RCU to __mpol_put() so that mempolicy objects are not freed while futex_key_to_node_opt() may still dereference them (prevents slab-use-after-free in __futex_key_to_node/kernel/futex/core.c).
Linux kernel futex/mempolicy code Add RCU to __mpol_put() = enabled - Compensating control
Consider applying a kernel mitigations strategy that enforces proper speculative mmap locking/RCU behavior between futex_key_to_node_opt() and vma_replace_policy(), to prevent __futex_key_to_node() from dereferencing a freed mempolicy.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23415?
CVE-2026-23415 is classified as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2026-23415?
To fix CVE-2026-23415, update your Linux kernel to version 6.19.11 or later.
Which Linux kernel versions are affected by CVE-2026-23415?
CVE-2026-23415 affects Linux kernel versions between 6.16.1 and 6.18.21 and various 7.0 release candidates.
What type of vulnerability is CVE-2026-23415?
CVE-2026-23415 is a use-after-free vulnerability related to futex handling in the Linux kernel.
Is there a workaround for CVE-2026-23415?
There is no specific workaround for CVE-2026-23415, so it is recommended to apply the kernel update.