{"id":"CVE-2026-80777","title":"futex/pi: Plug private futex exec() race","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the s…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < fdf538b2e69653ff740e84042245018e5680cd7b","Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < 0478bc6bf197629fea0331d65b39eeea043c6cf0","Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < d7944cee62ec6cca1c90780a766960a57d3b4bb8","Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc","Linux 6.16"],"published":"2026-09-04","updated":"2026-10-19","sourceUpdated":"2026-10-19T08:43:32.707Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80777","references":[{"url":"https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b"},{"url":"https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0"},{"url":"https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8"},{"url":"https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"}],"tags":["cve.org"],"epss":0.00209,"epssPercentile":0.10312,"ingestedAt":"2026-10-19T10:20:54.954Z","slug":"CVE-2026-80777","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner's mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n  exec()\n  ...\n    exec_release_mm()\n      futex_exec_release()\n        tsk::futex::exit_state = EXITING;\n        cleanup_robust_list();\n1)      tsk::futex::exit_state = OK;\n    ...\n    old_mm = tsk::mm;\n2)  tsk::mm = ->mm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n  1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n     futex_exec_release()\n\n  2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n     the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again.\n\n## Affected\n\n- `Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < fdf538b2e69653ff740e84042245018e5680cd7b`\n- `Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < 0478bc6bf197629fea0331d65b39eeea043c6cf0`\n- `Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < d7944cee62ec6cca1c90780a766960a57d3b4bb8`\n- `Linux >= 80367ad01d93ac781b0e1df246edaf006928002f < c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc`\n- `Linux 6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}