CVE-2025-39976

A flaw was found in the Linux kernel’s futex subsystem: when copy_process() fails in the call to futex_hash_allocate_default(), the code erroneously jumps to an incorrect error-exit label (bad_fork_core_free) that attempts to unlock locks (tasklist_lock and siglock) which were never acquired. This improper error-handling can leave the kernel in an inconsistent locking state, potentially leading to a deadlock or other kernel instability.

A moderate-impact flaw was found in the Linux kernel's futex subsystem. When copy_process() fails in its call to futex_hash_allocate_default(), it takes an incorrect error-exit path: control jumps to the bad_fork_core_free label, which releases tasklist_lock and siglock even though neither lock has been acquired at that point. If a local process hits this failure path during process creation, the kernel is left in an inconsistent locking state, which can lead to a deadlock or other kernel instability. Red Hat rates this flaw as Moderate (CVSS 4.5, local attack vector, high attack complexity, low privileges required) because the flawed path is only reached when an internal allocation fails during fork/clone, making it difficult to trigger reliably, with limited impact on confidentiality, integrity, and availability. This differs from the CVE.org severity of 7.8 (Important), which assumes low attack complexity and high confidentiality, integrity, and availability impact. The affected code was introduced upstream in Linux kernel 6.16 and is not present in the Red Hat Enterprise Linux 7, 8, 9, and 10 kernels (including kernel-rt) or in Red Hat In-Vehicle OS, so those products are not affected; the flaw is only recorded against Red Hat Enterprise Linux 6 Extended Lifecycle Support, which is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.