CVE-2012-0028: The robust futex implementation in the Linux kernel before 2.6.28 does not properly handle processes that m...

Security readout for executives and security teams

This is an old Linux kernel local vulnerability in the robust futex code. A user who can run code on an affected system could cause denial of service, and the CVE notes possible privilege gain. The issue is fixed in Linux 2.6.28-era upstream code, but vendor backports must be verified. Exposure is most likely on legacy Linux systems running kernels before 2.6.28 or vendor kernels lacking the futex robust_list fix. The attacker must already have local code execution. Modern supported distributions are unlikely to be exposed, but embedded, appliance, or frozen legacy builds need verification. Treat this as a legacy estate and shared-hosting risk, not an internet-wide emergency. Prioritize verification where old Linux kernels support multi-user, hosted, or appliance workloads. The main business concern is unsupported systems where local bugs can become outages or privilege-boundary failures. Mitigation focus: Apply a vendor-supported kernel update containing the robust futex execve fix.; Verify legacy kernels include upstream commit 8141c7f3e7ae or an equivalent backport.; Prioritize systems with untrusted local users or multi-tenant workloads..

Prepared

Jun 24, 2026, 12:34 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.