The implementation of the futex (fast userspace mutex) system call revealed and fixed the use of stack memory after it had been freed. This, in turn, allowed an attacker to execute their code in kernel context, with all resulting security implications. The vulnerability was found in the error handling code.
Correction The fix for this vulnerability appeared in the Linux mainline on January 28 and was included in kernels 5.10.12, 5.4.94, 4.19.172, and 4.14.218 two days ago.
During the discussion of this fix, it was suggested that this vulnerability exists in all kernels dating back to 2008:
https://www.openwall.com/lists/oss-security/2021/01/29/3
FWIW, this commit has:
Fixes: 1b7558e457ed ("futexes: fix fault handling in futex_lock_pi")
and that other commit is from 2008. So probably all currently
maintained Linux distros and deployments are affected, unless something
else mitigated the issue in some kernel versions.
Source: linux.org.ru
