{"id":"CVE-2026-23415","state":"PUBLISHED","title":"futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\n\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n\n[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n\n[  151.415969] Call Trace:\n\n[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)\n[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)\n[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\n\nFix by adding rcu to __mpol_put().","publishedAt":"2026-04-02T11:40:56.476Z","updatedAt":"2026-10-19T18:35:43.155Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"853f70c67d1b37e368fdcb3e328c4b8c04f53ac0","versionType":"git"},{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"7e196194ea27bd49adf3551e2aceb83498eb73fe","versionType":"git"},{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"190a8c48ff623c3d67cb295b4536a660db2012aa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mempolicy.h","kernel/futex/core.c","mm/mempolicy.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mempolicy.h","kernel/futex/core.c","mm/mempolicy.c"]}],"references":["https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0","https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe","https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa"],"weaknesses":["CWE-416"],"ingestedAt":"2026-10-29T20:11:21.040Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/23xxx/CVE-2026-23415.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-23415","state":"PUBLISHED","datePublished":"2026-04-02T11:40:56.476Z","dateUpdated":"2026-10-19T18:35:43.155Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-01-13T15:37:46.014Z"},"containers":{"cna":{"title":"futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\n\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\n\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n\n[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n\n[  151.415969] Call Trace:\n\n[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)\n[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)\n[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\n\nFix by adding rcu to __mpol_put()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"853f70c67d1b37e368fdcb3e328c4b8c04f53ac0","versionType":"git"},{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"7e196194ea27bd49adf3551e2aceb83498eb73fe","versionType":"git"},{"version":"c042c505210dc3453f378df432c10fff3d471bc5","status":"affected","lessThan":"190a8c48ff623c3d67cb295b4536a660db2012aa","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mempolicy.h","kernel/futex/core.c","mm/mempolicy.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["include/linux/mempolicy.h","kernel/futex/core.c","mm/mempolicy.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0"},{"url":"https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe"},{"url":"https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerable path is reached through local futex2/io_uring futex operations using FUTEX2_MPOL against the caller's user address space. It is not exposed directly to remote packets or adjacent/physical inputs.\nAC:L - The attacker can control both sides of the race by running concurrent threads that invoke futex wake/wait key derivation and mbind()/set_mempolicy_home_node() policy replacement on the same VMA. No external victim timing or rare state is required once the affected CONFIG_FUTEX_MPOL kernel is in use.\nPR:L - Both futex operations and basic mbind() VMA policy replacement are available to an unprivileged local user for their own process address space. The only relevant capability check is for MPOL_MF_MOVE_ALL, which is not needed to replace the VMA policy and trigger the UAF.\nUI:N - No victim action is required; the attacker can create the mapping, set policy, and issue the racing syscalls directly. Exploitation is self-contained in attacker-controlled local processes/threads.\nS:U - The bug is in the kernel's futex/mempolicy handling and affects the same kernel security authority. This is a standard local kernel vulnerability rather than a VM/IOMMU or separate-scope boundary crossing.\nC:H - This is a kernel use-after-free of struct mempolicy during futex key derivation, and UAF conditions can expose freed kernel heap contents or be shaped with heap reuse. Following the higher-severity rule for UAFs, confidentiality impact is High.\nI:H - The stale mempolicy data influences futex hash node selection and subsequent kernel data structure access, making memory corruption or control-flow-relevant exploitation defensible under UAF heap reuse. Following the higher-severity rule for UAFs, integrity impact is High.\nA:H - The reported failure is a KASAN slab-use-after-free in __futex_key_to_node(), and stale or invalid policy data can crash/oops the kernel. A local attacker can trigger the race repeatedly, so availability impact is High."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:21:35.941Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.0"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-23415","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:07:55.880720Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-416","lang":"en","type":"CWE","description":"CWE-416 Use After Free"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T18:35:43.155Z"}}]}}}