PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-52973 Linux CVE debrief

CVE-2026-52973 is a HIGH-severity vulnerability in the Linux kernel, with a CVSS score of 7.8. The vulnerability is related to the futex subsystem and has been resolved by loosening the check for private default hash allocation. The vulnerability allows for a slab-use-after-free attack, potentially leading to privilege escalation. The Linux kernel maintainers have addressed this issue by modifying the need_futex_hash_allocate_default() function to cover any CLONE_VM clone, except vfork(). This change prevents the bugs that occur when sharing the mm in other ways. Users of the Linux kernel should review their configurations and ensure they are running the latest kernel version to mitigate this vulnerability.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-24
Original CVE updated
2026-09-03
Advisory published
2026-06-24
Advisory updated
2026-09-03

Who should care

System administrators and security teams responsible for Linux kernel-based systems should be aware of this vulnerability. They should review their system configurations, check for affected versions, and apply the necessary patches to mitigate the vulnerability. Additionally, developers working on Linux kernel-based projects should be aware of this vulnerability and ensure that their code does not introduce similar issues.

Technical summary

The vulnerability is caused by the need_futex_hash_allocate_default() function depending on strict pthread semantics, abusing CLONE_THREAD. This breaks the non-concurrency assumptions when doing the mm->futex_ref pcpu allocations, leading to bugs when sharing the mm in other ways. The fix loosens the check to cover any CLONE_VM clone, except vfork(), preventing the slab-use-after-free attack. The vulnerability has a CVSS score of 7.8 and is considered HIGH-severity. The attack vector is local, and the vulnerability requires low privileges to exploit.

Defensive priority

Apply the latest Linux kernel patches to mitigate this vulnerability. Review system configurations and ensure that the latest kernel version is running.

Recommended defensive actions

  • Apply the latest Linux kernel patches
  • Review system configurations
  • Ensure the latest kernel version is running
  • Monitor system logs for suspicious activity
  • Perform regular vulnerability assessments

Evidence notes

The vulnerability has been resolved by the Linux kernel maintainers. The fix loosens the check for private default hash allocation, preventing the slab-use-after-free attack. The vulnerability has a CVSS score of 7.8 and is considered HIGH-severity.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-52973 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-52973

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-52973 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-52973

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1dcd36420af2da5bd59306dba9caf78e3d248b1d

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/974ac49a9a068b0591a59f65c63eb06579a13091

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ee9dce44362b2d8132c32964656ab6dff7dfbc6a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.