Linux Kernel CVE-2026-98281

Requires local code execution as an existing (even unprivileged) user who can run a program that establishes private futex waiters and then triggers vfork() or another CLONE_VM-based clone before the private futex hash has been allocated - the precise unsafe window the fix closes. This is not remotely reachable: AV:L and PR:L mean the attacker must already have an authenticated local account and the ability to execute arbitrary binaries. Exploitation is further limited by the need to reliably hit the race/ordering condition (futex waiters existing prior to private-hash allocation across the vfork boundary), which reduces reliability and favors a skilled attacker; systems without untrusted local users are at substantially lower practical risk. Only kernels in the affected ranges (e.g. 6.18.33-6.18.54, 7.0.10-7.1 and related) are vulnerable.

Signals are consistent and point to a genuine but non-urgent local-privilege-class kernel flaw rather than an internet-facing emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) confirms this is locally exploitable by an already-authenticated low-privileged user with no user interaction, yielding high confidentiality, integrity and availability impact - the classic profile of a kernel memory-safety bug leading to local privilege escalation. The EPSS score is very low (0.17%, 6th percentile), the CVE is NOT on the CISA KEV list, and no public exploit is referenced, so there is no evidence of active or imminent mass exploitation. The one countervailing signal is that the bug was found and demonstrated-as-reachable by a well-known researcher (Jann Horn), meaning exploitability is credible and weaponization by a skilled attacker is plausible even though no POC is published. Note a labeling tension: the input Tags list 'Information Disclosure', but the CVSS vector asserts C:H/I:H/A:H and the description concerns futex private-hash allocation on vfork()/CLONE_VM (a memory-management/use-after-free pattern typical of privilege escalation, not pure info disclosure) - treat the 'Information Disclosure' characterization with caution and verify impact against the upstream commits. Overall: real priority for multi-tenant and untrusted-local-user environments to patch on normal cadence, low priority as an emergency.

A local, low-privileged user on a shared Linux host runs a crafted program that creates futex waiters and then invokes vfork() (or another CLONE_VM path) before the private futex hash is allocated, reaching the mm in an inconsistent state. By winning the resulting race/triggering the unsafe access the attacker corrupts kernel memory to escalate to root. No public exploit code is identified at time of analysis, but reachability was demonstrated by the reporting researcher.