CVE-2026-52973: futex: Drop CLONE_THREAD requirement for private default hash alloc
In the Linux kernel, the following vulnerability has been resolved:
futex: Drop CLONETHREAD requirement for private default hash alloc
Currently needfutexhashallocatedefault() depends on strict pthread semantics, abusing CLONETHREAD. This breaks the non-concurrency assumptions when doing the mm->futexref pcpu allocations, leading to bugs[0] when sharing the mm in other ways; ie:
BUG: KASAN: slab-use-after-free in futexhashput
... where the +1 bias can end up on a percpu counter that mm->futexref no longer points at.
Loosen the check to cover any CLONEVM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and we can't race in the first place: either the parent is suspended and the child runs alone, or mm->futexref is already allocated from an earlier CLONEVM.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52973?
The severity of CVE-2026-52973 is rated at 34.
How does CVE-2026-52973 affect the Linux kernel?
CVE-2026-52973 affects the Linux kernel by breaking non-concurrency assumptions related to futex hash allocation.
What type of vulnerability is CVE-2026-52973 classified as?
CVE-2026-52973 is classified as a Use After Free vulnerability.
Has CVE-2026-52973 been resolved?
Yes, CVE-2026-52973 has been resolved in the Linux kernel.
What is the impact of the CVE-2026-52973 vulnerability?
The impact of CVE-2026-52973 can lead to potential stability issues due to improper handling of thread allocation.