---
id: CVE-2026-23415
title: 'futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

  During futex_key_to_node_opt() execution, vma->vm_policy is read under
  speculative mmap lock an…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= c042c505210dc3453f378df432c10fff3d471bc5 <
    853f70c67d1b37e368fdcb3e328c4b8c04f53ac0
  - >-
    Linux >= c042c505210dc3453f378df432c10fff3d471bc5 <
    7e196194ea27bd49adf3551e2aceb83498eb73fe
  - >-
    Linux >= c042c505210dc3453f378df432c10fff3d471bc5 <
    190a8c48ff623c3d67cb295b4536a660db2012aa
  - Linux 6.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:07:55.880720Z'
exploitAvailable: true
published: '2026-04-02'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:55.614Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23415'
references:
  - url: 'https://git.kernel.org/stable/c/853f70c67d1b37e368fdcb3e328c4b8c04f53ac0'
  - url: 'https://git.kernel.org/stable/c/7e196194ea27bd49adf3551e2aceb83498eb73fe'
  - url: 'https://git.kernel.org/stable/c/190a8c48ff623c3d67cb295b4536a660db2012aa'
tags:
  - cve.org
  - exploit-available
epss: 0.00131
epssPercentile: 0.02418
exploits:
  github: 1
  githubRepos:
    - 'https://github.com/addman2/uaf-exploit-cve-2026-23415'
  checkedAt: '2026-10-16T17:25:21.009Z'
ingestedAt: '2026-10-16T17:24:46.645Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy()

During futex_key_to_node_opt() execution, vma->vm_policy is read under
speculative mmap lock and RCU. Concurrently, mbind() may call
vma_replace_policy() which frees the old mempolicy immediately via
kmem_cache_free().

This creates a race where __futex_key_to_node() dereferences a freed
mempolicy pointer, causing a use-after-free read of mpol->mode.

[  151.412631] BUG: KASAN: slab-use-after-free in __futex_key_to_node (kernel/futex/core.c:349)
[  151.414046] Read of size 2 at addr ffff888001c49634 by task e/87

[  151.415969] Call Trace:

[  151.416732]  __asan_load2 (mm/kasan/generic.c:271)
[  151.416777]  __futex_key_to_node (kernel/futex/core.c:349)
[  151.416822]  get_futex_key (kernel/futex/core.c:374 kernel/futex/core.c:386 kernel/futex/core.c:593)

Fix by adding rcu to __mpol_put().

## Affected

- `Linux >= c042c505210dc3453f378df432c10fff3d471bc5 < 853f70c67d1b37e368fdcb3e328c4b8c04f53ac0`
- `Linux >= c042c505210dc3453f378df432c10fff3d471bc5 < 7e196194ea27bd49adf3551e2aceb83498eb73fe`
- `Linux >= c042c505210dc3453f378df432c10fff3d471bc5 < 190a8c48ff623c3d67cb295b4536a660db2012aa`
- `Linux 6.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.