CVE-2026-31554: futex: Require sys_futex_requeue() to have identical flags
In the Linux kernel, the following vulnerability has been resolved:
futex: Require sysfutexrequeue() to have identical flags
Nicholas reported that his LLM found it was possible to create a UaF when sysfutexrequeue() is used with different flags. The initial motivation for allowing different flags was the variable sized futex, but since that hasn't been merged (yet), simply mandate the flags are identical, as is the case for the old style sysfutex() requeue operations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.80 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.21 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.11 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Compensating control
Ensure sys_futex_requeue() is used only with identical flags for the source and destination futexes.
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access and low privileges are required. No user interaction is required.
What condition is needed to trigger the use-after-free?
The issue is triggered when sys_futex_requeue() is used with different flags. The fix requires the flags to be identical, matching the behavior of the older sys_futex() requeue operations.
Are systems using the default futex requeue behavior affected?
The available information identifies mismatched flags in sys_futex_requeue() as the relevant condition. It does not state whether a default application or system configuration performs such calls.
What is the potential impact if exploitation succeeds?
The CVSS assessment rates confidentiality, integrity, and availability impact as high. The underlying flaw is a use-after-free in the Linux kernel.