Use-After-Free Vulnerability in Linux Kernel's Futex Mechanism

CVE-2026-90003

What is CVE-2026-90003?

A vulnerability in the Linux kernel's futex subsystem allows for a use-after-free condition through a race between early wakeups and priority inheritance requeue operations. Specifically, if a task is woken up unexpectedly, it may leave the syscall before a requeue operation completes, leading to potential exploitation scenarios that compromise system stability and security. The vulnerability arises when the state of a futex is published before the proper wake conditions are met, creating an opportunity for tasks to reference invalid memory locations. This issue necessitates careful handling of futex states to prevent misuse.

References