CoreCVE
Back

HIGH

rtmutex: Use waiter::task instead of current in remove_waiter()

Published May 21, 2026

Description

remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().

In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:

1) the rbtree dequeue happens without waiter::task::pi_lock being held

2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.

3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task

Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.

[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

Affected products

Remediation

Red Hat mitigation

See the security bulletin for a detailed mitigation procedure.

Weaknesses (2)

CWE-416

Use After Free

CWE-825

References (16)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner Linux
Published May 21, 2026
Updated Sep 8, 2026
Reserved May 1, 2026
Link CVE-2026-43499
CISA Vulnrichment
Updated Aug 22, 2026
NVD
Status Modified
Modified Sep 8, 2026
Link CVE-2026-43499
Red Hat
Severity Important
Public date May 21, 2026
Links CVE-2026-43499 - Bugzilla
ENISA EUVD
Assigner Linux
Published May 21, 2026
Updated Sep 8, 2026
Exploited since n/a
Link EUVD-2026-31277
EUVD-2026-31277