CVE-2026-23415 futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

High 7.8 Published 2 Apr 2026 Updated 19 Oct 2026

A race condition in the Linux kernel futex subsystem allows a use-after-free, potentially enabling local attackers to execute code or escalate privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2026-23415?

CVE-2026-23415 is a high-severity use after free vulnerability in Linux kernel, published on 2 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_free().

This creates a race where __futex_key_to_node() dereferences a freed mempolicy pointer, causing a use-after-free read of mpol->mode.

[ 151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349) [ 151.414046] Read of size 2 at addr ffff888001c49634 by task e/87

[ 151.415969] Call Trace:

[ 151.416732] __asan_load2 (mm/kasan/generic.c:271) [ 151.416777] __futex_key_to_node (kernel/futex/core.c:349) [ 151.416822] get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)

Fix by adding rcu to __mpol_put().

Weakness: CWE-416

Which versions are affected by CVE-2026-23415?

It affects 1 product.

Products include Linux kernel.

How do I fix CVE-2026-23415?

Apply the vendor's patch.

Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.

Is CVE-2026-23415 being exploited?

There is no known exploitation of CVE-2026-23415 in the wild and no public exploit code.

Public exploit code: 1 proofs of concept on GitHub.

All Linux kernel vulnerabilities

Sources

Also known as BELL-CVE-2026-23415, DEBIAN-CVE-2026-23415, GHSA-chr7-rqmr-q86r, UBUNTU-CVE-2026-23415.