--- x/kernel/futex/core.c
+++ y/kernel/futex/core.c
@@ -248,7 +248,9 @@ static bool __futex_pivot_hash(struct mm
 			return false;
 		}
 
+		rcu_read_lock();
 		futex_rehash_private(fph, new);
+		rcu_read_unlock();
 	}
 	rcu_assign_pointer(mm->futex_phash, new);
 	kvfree_rcu(fph, rcu);