VYPR
← All advisories
High severity7.8NVD Advisory· Published May 21, 2026· Updated Jun 1, 2026

CVE-2026-43499

CVE-2026-43499

Description

In the Linux kernel, the following vulnerability has been resolved:

rtmutex: Use waiter::task instead of current in remove_waiter()

remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().

In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:

1) the rbtree dequeue happens without waiter::task::pi_lock being held

2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.

3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task

Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.

[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

164

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.