CVE-2026-80758

A flaw was found in the Linux kernel's futex subsystem. A race condition in the futex_private_hash_put() function allows a local attacker to trigger a use-after-free vulnerability. This occurs when a reference to a private hash is dropped prematurely, enabling another process to free the memory while the original task still holds a pointer to it. Successful exploitation could lead to a denial of service or potentially privilege escalation.

A use-after-free read can occur in futex_private_hash_put because futex_ref_put may drop the final reference to the private futex hash before the code reads the saved mm pointer. If the task is preempted after the final put, another task can switch to a replacement hash and the old hash can be freed after an RCU grace period, so the resumed task reads fph mm from freed memory. For the CVSS the PR:L is selected because a local unprivileged process is needed to create futex activity and reach the affected futex private hash path. The issue is not network reachable and requires local code execution. Impact is at least local denial of service via kernel crash or corrupted wakeup behavior. In the paranoid interpretation it may allow limited confidentiality or integrity impact due to kernel use-after-free behavior and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.