--- id: CVE-2026-43499 title: |- In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_… summary: |- In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_… severity: high cvss: 7.8 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H' cwe: - CWE-416 - CWE-825 vendor: linux product: linux_kernel affected: - 'linux_kernel >= 2.6.39, < 6.1.175' - 'linux_kernel >= 6.2, < 6.6.140' - 'linux_kernel >= 6.7, < 6.12.86' - 'linux_kernel >= 6.13, < 6.18.27' - 'linux_kernel >= 6.19, < 7.0.4' patched: - linux_kernel 7.0.4 published: '2026-05-21' updated: '2026-09-08' sourceUpdated: '2026-09-08T09:18:05.213' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43499' references: - url: 'https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7' label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - url: 'http://www.openwall.com/lists/oss-security/2026/07/08/12' label: af854a3a-2127-422b-91ae-364da2661108 - url: 'https://cert-portal.siemens.com/productcert/html/ssa-019113.html' label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43499.json - url: 'https://access.redhat.com/security/cve/CVE-2026-43499' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2480453' - url: 'https://access.redhat.com/security/vulnerabilities/RHSB-2026-010' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-43499' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-43499' - url: >- https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T - url: 'https://access.redhat.com/errata/RHSA-2026:37728' - url: 'https://access.redhat.com/errata/RHSA-2026:41920' - url: 'https://access.redhat.com/errata/RHSA-2026:41235' - url: 'https://access.redhat.com/errata/RHSA-2026:41234' - url: 'https://access.redhat.com/errata/RHSA-2026:41062' - url: 'https://access.redhat.com/errata/RHSA-2026:38492' - url: 'https://access.redhat.com/errata/RHSA-2026:40082' - url: 'https://access.redhat.com/errata/RHSA-2026:41063' - url: 'https://access.redhat.com/errata/RHSA-2026:40425' - url: 'https://access.redhat.com/errata/RHSA-2026:38491' - url: 'https://access.redhat.com/errata/RHSA-2026:59143' - url: 'https://access.redhat.com/errata/RHSA-2026:39083' - url: 'https://access.redhat.com/errata/RHSA-2026:59146' - url: 'https://access.redhat.com/errata/RHSA-2026:39984' - url: 'https://access.redhat.com/errata/RHSA-2026:40068' - url: 'https://access.redhat.com/errata/RHSA-2026:40760' - url: 'https://access.redhat.com/errata/RHSA-2026:59142' - url: 'https://access.redhat.com/errata/RHSA-2026:59147' - url: 'https://access.redhat.com/errata/RHSA-2026:59145' - url: 'https://access.redhat.com/errata/RHSA-2026:59148' - url: 'https://access.redhat.com/errata/RHSA-2026:59149' - url: 'https://access.redhat.com/errata/RHSA-2026:39082' - url: 'https://access.redhat.com/errata/RHSA-2026:39983' tags: - nvd - cve.org - exploit-available - csaf - vex - red-hat exploitAvailable: true ssvc: exploitation: poc automatable: 'no' technicalImpact: total timestamp: '2026-08-22T03:55:28.271423Z' epss: 0.00789 epssPercentile: 0.54716 exploits: github: 138 githubRepos: - 'https://github.com/BuSung-dev/Root-My-Galaxy' - 'https://github.com/YuKongA/ghostlock-app' - 'https://github.com/JoinChang/ghostlock-oneplus' checkedAt: '2026-09-23T07:14:05.086Z' ingestedAt: '2026-07-08T23:48:05.499Z' --- ## Overview In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ] ## Affected - `linux_kernel >= 2.6.39, < 6.1.175` - `linux_kernel >= 6.2, < 6.6.140` - `linux_kernel >= 6.7, < 6.12.86` - `linux_kernel >= 6.13, < 6.18.27` - `linux_kernel >= 6.19, < 7.0.4` ## Remediation Upgrade past the affected range: - `linux_kernel 7.0.4` ## Vendor advisories - **RHSA-2026:37728** · Red Hat · fixed in: NVIDIA for RHEL 10 · released 2026-07-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:37728) - **RHSA-2026:41920** · Red Hat · fixed in: Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION), Red Hat Enterprise Linux Server Optional -EXTENSION (v. 6 ELS -EXTENSION) · released 2026-07-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:41920) - **RHSA-2026:41235** · Red Hat · fixed in: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS) · released 2026-07-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:41235) - **RHSA-2026:41234** · Red Hat · fixed in: Red Hat Enterprise Linux for Real Time (v. 7 ELS) · released 2026-07-17 · [advisory](https://access.redhat.com/errata/RHSA-2026:41234) - **RHSA-2026:41062** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0) · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41062) - **RHSA-2026:38492** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), Red Hat Enterprise Linux Real Time (v. 10) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38492) - **RHSA-2026:40082** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2) · released 2026-07-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:40082) - **RHSA-2026:41063** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4) · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:41063) - **RHSA-2026:40425** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6) · released 2026-07-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:40425) - **RHSA-2026:38491** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-07-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:38491) - **RHSA-2026:59143** · Red Hat · fixed in: Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59143) - **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-08 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43499.json)