CVE-2025-39976

In the Linux kernel, a vulnerability was found in the futex subsystem's hash allocation function. The function futex_hash_allocate_default() is called during process creation in copy_process(). If this function fails, the error path incorrectly jumps to the bad_fork_core_free label, which attempts to release tasklist_lock and siglock. However, these locks have not been acquired at that point in the code, leading to a lock imbalance.

The bug is a classic error handling mistake. The correct exit label should be bad_fork_cancel_cgroup, as the subsequent steps after futex_hash_allocate_default() do not involve any resource allocations that need freeing. The error path should skip the lock release that was intended for a different stage.

The impact of this bug is potential system instability. An attacker who can cause a failure in futex_hash_allocate_default(), for example by exhausting memory, could trigger the incorrect error path, resulting in a kernel lock inversion or crash. This could lead to a denial of service condition.

The issue has been fixed in the Linux kernel with the referenced commit. Users are advised to update to a patched kernel version.