CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-21 · updated 2026-10-15
Weakness: CWE-416

Description

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

Affected products

Linux kernel: from 2.6.39 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.86; from 6.13 before 6.18.27; from 6.19 before 7.0.4 — fixed in 6.1.175, 6.12.86, 6.18.27, 6.6.140, 7.0.4

How to fix

Upgrade to a fixed version: Linux kernel 6.1.175, 6.12.86, 6.18.27, 6.6.140. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-43499 or the next vulnerability affects your stack