AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-825

https://access.redhat.com/security/cve/CVE-2026-52973

https://bugzilla.redhat.com/show_bug.cgi?id=2492413

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-52973.json

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"affected","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unknown","cpes":["cpe:/o:redhat:enterprise_linux:6"]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

futex: Drop CLONE_THREAD requirement for private default hash alloc

Currently need_futex_hash_allocate_default() depends on strict pthread
semantics, abusing CLONE_THREAD.  This breaks the non-concurrency
assumptions when doing the mm->futex_ref pcpu allocations, leading to
bugs[0] when sharing the mm in other ways; ie:

    BUG: KASAN: slab-use-after-free in futex_hash_put

... where the +1 bias can end up on a percpu counter that mm->futex_ref
no longer points at.

Loosen the check to cover any CLONE_VM clone, except vfork().  Excluding
vfork keeps the existing paths untouched (no overhead), and we can't
race in the first place: either the parent is suspended and the child
runs alone, or mm->futex_ref is already allocated from an earlier
CLONE_VM.

https://git.kernel.org/stable/c/1dcd36420af2da5bd59306dba9caf78e3d248b1d

https://git.kernel.org/stable/c/974ac49a9a068b0591a59f65c63eb06579a13091

https://git.kernel.org/stable/c/ee9dce44362b2d8132c32964656ab6dff7dfbc6a

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d9b05321e21e4b218de4ce8a590bf375f58b6346","lessThan":"1dcd36420af2da5bd59306dba9caf78e3d248b1d","versionType":"git","status":"affected"},{"version":"d9b05321e21e4b218de4ce8a590bf375f58b6346","lessThan":"974ac49a9a068b0591a59f65c63eb06579a13091","versionType":"git","status":"affected"},{"version":"d9b05321e21e4b218de4ce8a590bf375f58b6346","lessThan":"ee9dce44362b2d8132c32964656ab6dff7dfbc6a","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["kernel/fork.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"6.17","status":"affected"},{"version":"0","lessThan":"6.17","versionType":"semver","status":"unaffected"},{"version":"6.18.33","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.10","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]