{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23415", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:46.014Z", "datePublished": "2026-04-02T11:40:56.476Z", "dateUpdated": "2026-05-11T22:06:27.981Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:06:27.981Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\n\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n\n[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n\n[ 151.415969] Call Trace:\n\n[ 151.416732] __asan_load2 (mm/kasan/generic.c:271)\n[ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)\n[ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\n\nFix by adding rcu to __mpol_put()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mempolicy.h", "kernel/futex/core.c", "mm/mempolicy.c"], "versions": [{"version": "c042c505210dc3453f378df432c10fff3d471bc5", "lessThan": "853f70c67d1b37e368fdcb3e328c4b8c04f53ac0", "status": "affected", "versionType": "git"}, {"version": "c042c505210dc3453f378df432c10fff3d471bc5", "lessThan": "7e196194ea27bd49adf3551e2aceb83498eb73fe", "status": "affected", "versionType": "git"}, {"version": "c042c505210dc3453f378df432c10fff3d471bc5", "lessThan": "190a8c48ff623c3d67cb295b4536a660db2012aa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/linux/mempolicy.h", "kernel/futex/core.c", "mm/mempolicy.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0"}, {"url": "https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe"}, {"url": "https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa"}], "title": "futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ABCE137D-81F5-4A69-BEC9-C222E10F0BAF", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.16.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.16:-:*:*:*:*:*:*", "matchCriteriaId": "6238B17D-C12B-458F-A138-97039BFC4595", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:*", "matchCriteriaId": "1D2315C0-D46F-4F85-9754-F9E5E11374A6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:*", "matchCriteriaId": "512EE3A8-A590-4501-9A94-5D4B268D6138", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\n\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n\n[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n\n[ 151.415969] Call Trace:\n\n[ 151.416732] __asan_load2 (mm/kasan/generic.c:271)\n[ 151.416777] __futex_key_to_node (kernel/futex/core.c:349)\n[ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\n\nFix by adding rcu to __mpol_put()."}], "id": "CVE-2026-23415", "lastModified": "2026-04-27T14:16:31.483", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-02T12:16:20.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()", "id": "2454320", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454320"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel. A timing issue, known as a race condition, exists within the futex subsystem. This vulnerability could allow a local attacker to access memory after it has been freed, leading to a system crash (denial of service) or potentially the disclosure of sensitive information."], "name": "CVE-2026-23415", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23415\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23415\nhttps://lore.kernel.org/linux-cve-announce/2026040204-CVE-2026-23415-3435@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c042c505210dc3453f378df432c10fff3d471bc5,853f70c67d1b37e368fdcb3e328c4b8c04f53ac0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c042c505210dc3453f378df432c10fff3d471bc5,7e196194ea27bd49adf3551e2aceb83498eb73fe)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c042c505210dc3453f378df432c10fff3d471bc5,190a8c48ff623c3d67cb295b4536a660db2012aa)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.21,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.11,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T21:52:58.254666+00:00", "value": {"mitigation_remediation": ["Install a kernel version that includes the RCU protection patch for __mpol_put(), such as the latest distribution security update", "Apply a seccomp filter or capability restriction that blocks the mbind() syscall for processes that frequently use futexes, reducing the race window", "If updating is not immediately possible, minimize or eliminate usage of mbind() in applications, and isolate affected workloads in containers with restricted capabilities"], "summary": {"action": "Patch", "impact": "Use\u2011after\u2011free read in kernel futex handling"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that contain the unpatched futex routine are affected. The vulnerability applies to every distribution that ships a kernel version before the commit that adds RCU protection to __mpol_put(). Vendor product names such as \"Linux:Linux\" denote the operating system itself; no specific product name is required because the kernel is common across distributions.", "description_and_impact": "A race exists between futex_key_to_node_opt() and vma_replace_policy() in the Linux kernel. During concurrent mbind() calls the old mempolicy is freed while futex_key_to_node_opt() still reads it. This leads to a use\u2011after\u2011free read of the mpol->mode field, potentially causing a kernel crash or leaking kernel memory content. The bug manifests as a KASAN slab\u2011use\u2011after\u2011free error in __futex_key_to_node, as shown in the stack trace from the kernel trace logs.", "risk_and_exploitability": "The CVSS score of 7.8 classifies the flaw as high severity. An EPSS score below 1\u202f% and the absence of a listing in CISA's KEV catalog indicate a low overall exploitation probability. Exploitation requires a local or privileged attacker to orchestrate a race between futex usage and mbind() operations, which is non\u2011trivial. Consequently, while the impact is significant on a compromised system, the likelihood of real\u2011world exploitation remains low under normal operating conditions."}}}}, "created": "2026-04-02T20:12:49.080523+00:00", "updated": "2026-04-28T22:00:14.138977+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}