CVE-2026-43499

Vulnerability

In the Linux kernel, the remove_waiter() function in the rtmutex implementation is used by slowlock paths and also for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case, waiter::task is not current, but remove_waiter() incorrectly operates on current for the dequeue operation. This leads to three issues: (1) the rbtree dequeue occurs without holding waiter::task::pi_lock; (2) the waiter task's pi_blocked_on state is not cleared, leaving a dangling pointer primed for use-after-free; (3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task. The vulnerability affects Linux kernel versions prior to the inclusion of the fix commits [1], [2], [3], [4].

Exploitation

An attacker must be able to trigger a futex_requeue() operation that invokes proxy-lock rollback via rt_mutex_start_proxy_lock(). This requires local access to the system and the ability to manipulate futex operations in a way that causes the specific code path where remove_waiter() is called with a waiter::task different from current. The exact sequence involves setting up a futex requeue scenario that leads to the proxy-lock rollback, then exploiting the race window or the missing lock to corrupt kernel state.

Impact

Successful exploitation can lead to use-after-free (UAF) of the waiter task structure, potentially allowing an attacker to corrupt kernel memory and escalate privileges. Additionally, the incorrect priority chain manipulation can cause priority inversion, leading to denial of service or unpredictable scheduling behavior. The attacker may gain arbitrary code execution in kernel context, depending on the specific UAF exploitation technique.

Mitigation

The vulnerability is fixed in Linux kernel stable updates that include the commits referenced in [1], [2], [3], and [4]. Users should apply the latest kernel updates from their distribution. No workaround is available; the fix must be applied via kernel patching. The issue is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog as of the publication date.