CVE-2026-31554

A flaw was found in the Linux kernel. A local attacker could exploit a use-after-free vulnerability by calling the sys_futex_requeue() function with inconsistent flags. This could lead to a system crash, resulting in a denial of service, or potentially allow for privilege escalation.

Upstream now requires matching futex flags on futex_requeue so mismatched flag combinations cannot drive inconsistent waiter state. Red Hat considers this a local syscall-surface integrity fix. Deploy updated kernels; there is no practical module mitigation for core futex code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.