{
  "threat_severity" : "Moderate",
  "public_date" : "2026-04-02T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()",
    "id" : "2454320",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2454320"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.7",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-367",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nfutex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()\nDuring futex_key_to_node_opt() execution, vma->vm_policy is read under\nspeculative mmap lock and RCU. Concurrently, mbind() may call\nvma_replace_policy() which frees the old mempolicy immediately via\nkmem_cache_free().\nThis creates a race where __futex_key_to_node() dereferences a freed\nmempolicy pointer, causing a use-after-free read of mpol->mode.\n[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)\n[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87\n[  151.415969] Call Trace:\n[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)\n[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)\n[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)\nFix by adding rcu to __mpol_put().", "A flaw was found in the Linux kernel. A timing issue, known as a race condition, exists within the futex subsystem. This vulnerability could allow a local attacker to access memory after it has been freed, leading to a system crash (denial of service) or potentially the disclosure of sensitive information." ],
  "statement" : "Unprivileged processes routinely use futexes; `mbind()` on their own mappings is also available without special capability on typical configurations, so the race is not limited to root-only workloads. Minimum impact is abnormal termination or crash; information disclosure from the UAF read is plausible and should be reviewed manually.",
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-08-11T00:00:00Z",
    "advisory" : "RHSA-2026:53330",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.46.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-06T00:00:00Z",
    "advisory" : "RHSA-2026:51035",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.36.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-08-06T00:00:00Z",
    "advisory" : "RHSA-2026:51035",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.36.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-23415\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23415\nhttps://lore.kernel.org/linux-cve-announce/2026040204-CVE-2026-23415-3435@gregkh/T" ],
  "name" : "CVE-2026-23415",
  "csaw" : false
}