An improper validation in the Linux kernel’s futex PI subsystem allows a private futex key to reference a waiter in a different address space. When the owning process exits, the system may free the waiter's hash bucket while the owner still attempts to use it, resulting in a use‑after‑free condition that can corrupt kernel memory and potentially allow higher privileges.

This flaw exists in the Linux kernel’s futex PI implementation. Any Linux kernel built with the default futex PI support is susceptible, regardless of distribution, unless the kernel has been patched to include the recent commit that validates the owner and waiter address spaces.

The CVSS score is not reported, but use‑after‑free vulnerabilities are typically considered critical. The EPSS score is unavailable and the flaw is not currently listed in the CISA KEV catalog. An attacker requires local execution within a process that can use private futexes; therefore the attack vector is local. Successful exploitation could lead to kernel corruption and local privilege escalation or denial of service.