CVE-2026-80758 Overview
CVE-2026-80758 is a use-after-free vulnerability in the Linux kernel futex subsystem. The flaw resides in futex_private_hash_put(), which drops a reference to the private futex hash (fph) before evaluating fph->mm for wake_up_var(). When futex_ref_put() releases the final reference and the task is preempted, another task can pivot to a replacement hash and free the old allocation after an RCU grace period. The first task then reads fph->mm from the freed allocation on resume. KASAN reports a slab-use-after-free at offset 24 within a freed kmalloc-512 allocation, tied to futex_hash_allocate() and the RCU free path.
Critical Impact
Local attackers can trigger a kernel use-after-free through futex operations, potentially leading to memory corruption, information disclosure, or local privilege escalation.
Affected Products
- Linux kernel versions containing the private futex hash implementation prior to the fix
- Distributions shipping the vulnerable kernel commits referenced in stable trees
- Systems relying on FUTEX2 private hash functionality
Discovery Timeline
- 2026-09-04 - CVE-2026-80758 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80758
Vulnerability Analysis
The vulnerability is a classic use-after-free race condition in the Linux kernel futex private hash management code. The private hash structure (fph) tracks futex state per memory descriptor (mm). Reference counting via futex_ref_put() governs the lifecycle of these allocations.
The defective code path releases the reference to fph before reading fph->mm. Because futex_ref_put() re-enables preemption before returning, the calling task can be preempted between the reference drop and the subsequent field read. During that preemption window, another task can install a replacement hash and trigger reclamation of the old allocation after an RCU grace period. When the original task resumes, it dereferences memory that has been freed.
KASAN instrumentation confirms the flaw as a slab-use-after-free in futex_private_hash_put(), reading at offset 24 within a kmalloc-512 slab object. The allocation stack points to futex_hash_allocate(), and the free stack points to the RCU-deferred free path.
Root Cause
The root cause is an ordering error between reference release and field access. The pointer fph->mm is loaded after the reference count that keeps fph alive has already been decremented. No lock, RCU read-side critical section, or preemption disable spans both operations, so nothing prevents the allocation from being freed between the two accesses.
Attack Vector
Exploitation requires local code execution capable of issuing futex syscalls that exercise the private hash path. An attacker races futex operations across CPUs to trigger the final put, arranges preemption at the vulnerable window, and induces a concurrent thread to allocate a replacement hash and drop the old one via RCU. Successful exploitation results in reading freed slab memory, which can be leveraged for kernel information disclosure or, with slab reallocation primitives, for memory corruption leading to privilege escalation.
No verified public exploit code exists at the time of publication. Consult the upstream commits for technical remediation details: Linux Kernel Commit 12cd315, Linux Kernel Commit 1c7efab, Linux Kernel Commit 25408c6, and Linux Kernel Commit dba60d2.
Detection Methods for CVE-2026-80758
Indicators of Compromise
- KASAN kernel log entries reporting slab-use-after-free in futex_private_hash_put with reads at offset 24 of a kmalloc-512 slab.
- Kernel oops or panic traces referencing futex_private_hash_put, futex_ref_put, or futex_hash_allocate in the call chain.
- Unexpected kernel memory read faults on systems with heavy multithreaded futex workloads.
Detection Strategies
- Enable KASAN on test and canary kernels to surface the use-after-free during fuzzing or regression testing.
- Monitor dmesg and journald for kernel BUG, WARN, or KASAN reports tied to the futex subsystem.
- Correlate kernel crash telemetry with processes issuing high volumes of futex() syscalls targeting private futexes.
Monitoring Recommendations
- Forward kernel logs and crash reports to a centralized analytics pipeline for anomaly detection.
- Alert on repeated kernel warnings originating from the futex subsystem across a fleet of hosts.
- Track kernel package versions across the environment to identify hosts still running vulnerable builds.
How to Mitigate CVE-2026-80758
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor-built packages become available.
- Inventory Linux hosts and identify kernels containing the vulnerable private futex hash code.
- Prioritize patching multi-tenant systems and hosts exposed to untrusted local users or containerized workloads.
Patch Information
The upstream fix loads fph->mm while the fph reference is still held and passes the saved pointer to wake_up_var(). Because wake_up_var() treats the pointer only as a waitqueue key and does not dereference it, the change eliminates the use-after-free without altering wakeup semantics. Apply the vendor kernel update that incorporates the referenced commits: Linux Kernel Commit 12cd315, Linux Kernel Commit 1c7efab, Linux Kernel Commit 25408c6, and Linux Kernel Commit dba60d2.
Workarounds
- Restrict local access to trusted users only until a patched kernel is deployed.
- Constrain untrusted workloads with seccomp filters that limit or block futex() syscall usage where feasible.
- Reboot into a patched kernel promptly after installation to ensure the fix is active.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.