CVE-2026-98281: Linux

High severity, CVSS 7.8. EPSS: 0.1% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork() As Jann demonstrated, it is entirely feasible to access the mm through vfork(). Therefore we need to allocate a private hash on vfork() as well as any other CLONE_VM user. Specifically, it must be avoided to have (private) futex waiters before allocating the private hash.

Affected products

• Linux Linux: from 6.18.33, before 6.18.54 (fixed in 6.18.54); from 7.0.10, before 7.1 (fixed in 7.1); from 7.1, before 7.2.8 (fixed in 7.2.8)

Published 2026-10-06. Last modified 2026-10-07.