{"id":"CVE-2026-23415","revision":"28fe253a94d74fd199583661a32efe3b","records":[{"revision":"28fe253a94d74fd199583661a32efe3b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23415","aliases":[],"title":"futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\n\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n\n[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n\n[  151.415969] Call Trace:\n\n[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)\n[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)\n[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\n\nFix by adding rcu to __mpol_put().","state":0,"publishedAt":"2026-04-02T11:40:56.476+00:00","modifiedAt":"2026-10-19T18:35:43.155+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/mempolicy.h\",\n                        \"kernel/futex/core.c\",\n                        \"mm/mempolicy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"c042c505210dc3453f378df432c10fff3d471bc5\",\n                            \"lessThan\": \"853f70c67d1b37e368fdcb3e328c4b8c04f53ac0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c042c505210dc3453f378df432c10fff3d471bc5\",\n                            \"lessThan\": \"7e196194ea27bd49adf3551e2aceb83498eb73fe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"c042c505210dc3453f378df432c10fff3d471bc5\",\n                            \"lessThan\": \"190a8c48ff623c3d67cb295b4536a660db2012aa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"include/linux/mempolicy.h\",\n                        \"kernel/futex/core.c\",\n                        \"mm/mempolicy.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.21\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.11\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0","https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe","https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23415","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23415","identifiers":["CVE-2026-23415"]},"retained":false,"historicalAffected":[]}],"coverage":[]}