Skip to main content

Linux Kernel CVE-2026-52973

| EUVDEUVD-2026-38841 HIGH
Expired Pointer Dereference (CWE-825)
2026-06-24 Linux GHSA-9qj4-wr4g-7m6f
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local unprivileged code execution (AV:L/PR:L); AC:H because it requires the unusual CLONE_VM-not-CLONE_THREAD pattern and winning a lifetime race; the UAF yields full C/I/A impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:38 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:28 cve.org
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:28 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

futex: Drop CLONE_THREAD requirement for private default hash alloc

Currently need_futex_hash_allocate_default() depends on strict pthread semantics, abusing CLONE_THREAD. This breaks the non-concurrency assumptions when doing the mm->futex_ref pcpu allocations, leading to bugs[0] when sharing the mm in other ways; ie:

BUG: KASAN: slab-use-after-free in futex_hash_put

... where the +1 bias can end up on a percpu counter that mm->futex_ref no longer points at.

Loosen the check to cover any CLONE_VM clone, except vfork(). Excluding vfork keeps the existing paths untouched (no overhead), and we can't race in the first place: either the parent is suspended and the child runs alone, or mm->futex_ref is already allocated from an earlier CLONE_VM.

AnalysisAI

Local privilege escalation in the Linux kernel futex subsystem stems from a slab use-after-free in futex_hash_put, triggered when a process shares its mm via CLONE_VM without CLONE_THREAD. The flawed need_futex_hash_allocate_default() check broke the non-concurrency assumption for per-CPU mm->futex_ref allocation, letting a stale +1 bias land on a percpu counter the mm no longer references. Carries CVSS 7.8 (high) with full C/I/A impact; no public exploit identified at time of analysis and EPSS is low (0.17%).

Technical ContextAI

The bug lives in the kernel's fast userspace mutex (futex) private-hash machinery. Recent kernels (6.17+) allocate a default per-process futex hash and track its lifetime with a reference counter, mm->futex_ref, backed by a per-CPU counter. The allocation decision in need_futex_hash_allocate_default() keyed off CLONE_THREAD (strict pthread/thread-group semantics), but address spaces can be shared in other ways - any CLONE_VM clone. When the mm is shared outside a thread group, the non-concurrency assumption underpinning the percpu allocation is violated, so the reference-count bias can be applied to freed memory, producing the KASAN slab-use-after-free in futex_hash_put. The root-cause class is a use-after-free (CWE-416, though the feed records CWE as N/A) arising from an incorrect concurrency/lifetime assumption. CPE data identifies the affected component generically as cpe:2.3:a:linux:linux.

RemediationAI

Upstream fix available (stable commits); patched versions are confirmed in the stable trees - update to a kernel containing commits 1dcd36420af2da5bd59306dba9caf78e3d248b1d / 974ac49a9a068b0591a59f65c63eb06579a13091 / ee9dce44362b2d8132c32964656ab6dff7dfbc6a (stable lines around 6.18.33 and the 7.0.10/7.1 series). The cleanest action is to apply your distribution's kernel update once it ships the backport, then reboot. There is no clean feature-level workaround because futex private hashing is core kernel functionality and cannot be disabled without breaking applications; as a partial compensating control, restrict the ability of untrusted users to run arbitrary code or create CLONE_VM processes on sensitive hosts (e.g., tighten container/seccomp policy and limit interactive shell access), accepting that this only reduces, not eliminates, exposure. Reference the stable commits at git.kernel.org and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-52973.

Same weakness CWE-825 – Expired Pointer Dereference

View all
CVE-2025-49794 CRITICAL POC
9.1
CVE-2024-23310 CRITICAL POC
9.8
CVE-2026-58592 HIGH POC
8.9
CVE-2025-49795 HIGH POC
7.5
CVE-2019-15691 HIGH POC
7.2
CVE-2024-23638 MEDIUM POC
6.5
CVE-2026-53006 CRITICAL
9.8
CVE-2026-52924 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected

Share

CVE-2026-52973 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy