---
id: CVE-2026-31554
title: 'futex: Require sys_futex_requeue() to have identical flags'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  futex: Require sys_futex_requeue() to have identical flags

  Nicholas reported that his LLM found it was possible to create a UaF
  when sys_futex_requeue() is used with d…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff <
    027145ace09fad4c7cbcd6c61fe9b429c63eb0e5
  - >-
    Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff <
    18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a
  - >-
    Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff <
    e2f78c7ec1655fedd945366151ba54fcb9580508
  - >-
    Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff <
    19f94b39058681dec64a10ebeb6f23fe7fc3f77a
  - Linux 6.7
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:10:51.086249Z'
published: '2026-04-24'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:15.493Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-31554'
references:
  - url: 'https://git.kernel.org/stable/c/027145ace09fad4c7cbcd6c61fe9b429c63eb0e5'
  - url: 'https://git.kernel.org/stable/c/18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a'
  - url: 'https://git.kernel.org/stable/c/e2f78c7ec1655fedd945366151ba54fcb9580508'
  - url: 'https://git.kernel.org/stable/c/19f94b39058681dec64a10ebeb6f23fe7fc3f77a'
tags:
  - cve.org
epss: 0.00175
epssPercentile: 0.06538
ingestedAt: '2026-10-16T17:24:46.661Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

futex: Require sys_futex_requeue() to have identical flags

Nicholas reported that his LLM found it was possible to create a UaF
when sys_futex_requeue() is used with different flags. The initial
motivation for allowing different flags was the variable sized futex,
but since that hasn't been merged (yet), simply mandate the flags are
identical, as is the case for the old style sys_futex() requeue
operations.

## Affected

- `Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff < 027145ace09fad4c7cbcd6c61fe9b429c63eb0e5`
- `Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff < 18b7d09c2b794c71d4252f3ea2cf84ad12b73d6a`
- `Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff < e2f78c7ec1655fedd945366151ba54fcb9580508`
- `Linux >= 0f4b5f972216782a4acb1ae00dcb55173847c2ff < 19f94b39058681dec64a10ebeb6f23fe7fc3f77a`
- `Linux 6.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.