CVE-2026-80775

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists during the initial allocation of mm->futex.phash.ref within the futex hash allocate() function because it is performed without locking. This issue occurs during nested vfork calls; if a vfork child calls vfork again and is subsequently killed with SIGKILL, the parent and grandchild may run concurrently in the same memory management (mm) context. If both processes simultaneously call the prctl(PR FUTEX HASH, PR FUTEX HASH SET SLOTS) endpoint, they may both perceive mm->futex.phash.ref as NULL and store their own per-cpu counters. This leads to a situation where the first counter becomes unreachable, causing a private hash with active references to be incorrectly identified as dead and freed. Consequently, a task holding one of its buckets may write into freed memory within the futex q lock() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.