|
Vulnerabilities
< Back

CVE-2026-52973

Updated on 24 Jun 2026

Severity

7.0 High severity

Details

CVSS score
7.0
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

futex: Drop CLONE_THREAD requirement for private default hash alloc

Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non-concurrency assumptions when doing the mm->futex_ref pcpu allocations, leading to bugs[0] when sharing the mm in other ways; ie:

BUG: KASAN: slab-use-after-free in futex_hash_put

… where the +1 bias can end up on a percpu counter that mm->futex_ref no longer points at.

Loosen the check to cover any CLONE_VM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and we can’t race in the first place: either the parent is suspended and the child runs alone, or mm->futex_ref is already allocated from an earlier CLONE_VM.

Details

Affected product:
AlmaLinux 9.2 ESU , TuxCare 9.6 ESU
Affected packages:
kernel @ 5.14.0 (+1 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
AlmaLinux 10 Released
17 kernels
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
  • 6.12.0-211.31.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.7.4.el10_2
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2
  • 6.12.0-211.37.1.el10_2
  • 6.12.0-211.38.1.el10_2
AlmaLinux 9 Released
17 kernels
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.5.4.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
Oracle Linux 10 Released
4 kernels
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-211.34.1.el10_2
  • 6.12.0-211.37.1.el10_2
  • 6.12.0-211.38.1.el10_2
Oracle Linux 9 Released
11 kernels
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
RHEL 10 Released
16 kernels
  • 6.12.0-211.16.1.el10_2
  • 6.12.0-211.7.1.el10_2
  • 6.12.0-211.7.3.el10_2
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.20.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.29.1.el10_2
  • 6.12.0-211.30.1.el10_2
  • 6.12.0-211.31.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2
  • 6.12.0-211.37.1.el10_2
  • 6.12.0-211.38.1.el10_2
RHEL 9 Released
16 kernels
  • 5.14.0-687.5.1.el9_8
  • 5.14.0-687.5.3.el9_8
  • 5.14.0-687.10.1.el9_8
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.13.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.19.1.el9_8
  • 5.14.0-687.20.1.el9_8
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.23.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8
Rocky Linux 10 Released
9 kernels
  • 6.12.0-211.18.1.el10_2
  • 6.12.0-211.22.1.el10_2
  • 6.12.0-211.26.1.el10_2
  • 6.12.0-211.28.1.el10_2
  • 6.12.0-211.32.1.el10_2
  • 6.12.0-211.16.1.el10_2.0.1
  • 6.12.0-211.33.1.el10_2
  • 6.12.0-211.34.1.el10_2
  • 6.12.0-211.37.1.el10_2
Rocky Linux 9 Released
10 kernels
  • 5.14.0-687.12.1.el9_8
  • 5.14.0-687.15.1.el9_8
  • 5.14.0-687.17.1.el9_8
  • 5.14.0-687.10.1.el9_8.0.1
  • 5.14.0-687.22.1.el9_8
  • 5.14.0-687.24.1.el9_8
  • 5.14.0-687.25.1.el9_8
  • 5.14.0-687.26.1.el9_8
  • 5.14.0-687.29.1.el9_8
  • 5.14.0-687.30.1.el9_8