This flaw is a race condition that occurs in the Linux kernel's futex subsystem. When a process performing a vfork nests another vfork and the child is subsequently killed with SIGKILL, the parent resumes execution concurrently with the grandchild in the same memory context. Both processes can then call prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) simultaneously, each assuming that the futex hash reference mm->futex.phash.ref is NULL. Because the allocation of this reference lacks synchronization, both processes store separate per‑cpu counters, but only the last store persists. The first counter becomes unreachable, its reference counts are untracked, and the hash is incorrectly freed. A task that still owns a reference to that freed hash may then write into the reclaimed memory during futex_q_lock(), resulting in a use‑after‑free that can corrupt kernel memory and potentially lead to arbitrary code execution or kernel panic.

The vulnerability affects the Linux kernel itself. All distributions that ship a kernel version prior to the inclusion of the fix are potentially impacted. No specific version range is listed in the available data, so any kernel lacking the commit that introduced the race condition patch is susceptible.

The CVSS score is not provided and the EPSS score is unavailable, so the exact severity ranking is unknown. However, the presence of a use‑after‑free in the kernel is a high‑risk condition. The flaw requires local interaction with a process that performs multiple vforks and uses the PR_FUTEX_HASH ioctl; thus, exploitation would be constrained to a local or privileged attacker who can control such code paths. If successfully exploited, the attacker could corrupt kernel memory, potentially gain privilege escalation or crash the system. The lack of an official KEV listing indicates that no widespread exploit has yet been documented, but the flaw remains a serious security concern due to the critical nature of use‑after‑free bugs in kernel code.