CVE-2026-31555

Vulnerability

Analysis

CVE-2026-31555 is a Linux kernel vulnerability in the FUTEX_LOCK_PI syscall path. When futex_lock_pi_atomic() detects that the futex owner is exiting, it returns -EBUSY and stores a refcounted pointer to the exiting task in the local variable exiting. After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to NULL. On a subsequent retry without clearing the pointer leads to a WARN_ON() in wait_for_owner() because the stale pointer is passed again [1].

Exploitation

Scenario

The bug is triggered by concurrent futex operations and an exiting process. A local attacker on the same kernel can induce the race by issuing overlapping futex lock and exit calls. The attack requires no privileges beyond the ability to execute code and create threads on the system. The root cause is a missing pointer nullification in the retry path of futex_lock_pi() [1].

Impact

When the stale pointer is reused, the kernel triggers a WARN_ON() in core.c. This warning itself does not crash the system, but it indicates a potential logic error that could be escalated further. The official description and fix confirm that this is a local denial-of-service scenario as the warning conditions can be hit repeatedly by a malicious fuzzer or attacker [1].

Mitigation

Patches have been applied to the upstream Linux kernel repository and backported to stable branches. The fix aligns the behavior with the already corrected requeue_pi code path [1]. Administrators should apply the latest kernel updates from their distribution to eliminate the vulnerability.