{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "56180dd20c19e5b0fa34822997a9ac66b517e7b3"
            },
            {
              "fixed": "5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af"
            },
            {
              "fixed": "f35e3b5784221654f9cdbd6222275a7fa203f6c3"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.17.0"
            },
            {
              "fixed": "7.2.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98788.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix private hash use-after-free on resize\n\npoll_state_synchronize_rcu(mm-\u003efutex.phash.batches) is used by\nfutex_ref_drop() to check that a grace period has passed since the\ncurrent hash was published. This relies on batches referencing a grace\nperiod which started after the hash pointer was assigned.\n\n__futex_pivot_hash() sets mmph-\u003ebatches before it replaces mmph-\u003ehash:\n\n    scoped_guard(rcu) {\n            mmph-\u003ebatches = get_state_synchronize_rcu();\n            rcu_assign_pointer(mmph-\u003ehash, new);\n    }\n\nThe scoped_guard(rcu) doesn't stop new grace periods from starting, and\nif one starts between those two assignments, futex_ref_drop() can move\nforward while a reader still holds a pointer to the old hash.\n\nFix things by setting mmph-\u003ebatches after assigning mmph-\u003ehash.  The\nscoped_guard(rcu) isn't needed, so let's drop that as well.",
  "id": "CVE-2026-98788",
  "modified": "2026-10-20T02:31:05.354479214Z",
  "published": "2026-10-18T15:48:24.833Z",
  "references": [
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d5dc18b3a9ac011619b7d3af4514bf9e9b6a6af"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f35e3b5784221654f9cdbd6222275a7fa203f6c3"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98788.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98788"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "futex: Fix private hash use-after-free on resize"
}