---
id: CVE-2026-90003
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  futex: Prevent rcuwait use-after-free during requeue PI

  On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
  (slab-out-of-bounds) in futex_requeue_pi_complet…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  futex: Prevent rcuwait use-after-free during requeue PI

  On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
  (slab-out-of-bounds) in futex_requeue_pi_complet…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    220ee9e04ca3b7f014c000264aa6c884f036c86e
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    81aadbd09bf1dcd3238212f336ba699503557ae8
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    244f301759fd34b1dd0b4192ce44f8ef224e027d
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    7d1559126d86be6e4f6a85663dfbfe85caa47e37
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    e4a4ccfa470f910b747b3ee8d18670ed8ac8a236
  - >-
    Linux >= 07d91ef510fb16a2e0ca7453222105835b7ba3b8 <
    a3b8d46fe401cba3a5c46dea610e6eb3dc15370e
  - Linux 5.15
published: '2026-09-16'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T15:18:24.143'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90003'
references:
  - url: 'https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-16T10:53:53.943Z'
epss: 0.00171
epssPercentile: 0.05672
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

futex: Prevent rcuwait use-after-free during requeue PI

On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report
(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of
rcuwait_wake_up().

The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's
stack. An early wakeup can race with a PI requeue as follows:

        waiter                          requeue task
        ------                          ------------
futex_wait_requeue_pi()
  futex_do_wait()
    schedule()
                                       futex_requeue
                                         futex_proxy_trylock_atomic()
                                           futex_requeue_pi_prepare()
                                            Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS
* timeout/ signal wakes waiter *
  futex_requeue_pi_wakeup_sync()
   Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT
                                           requeue_pi_wake_futex
                                             futex_requeue_pi_complete()
                                               cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED
    rcuwait_wait_event()
      if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)
       break /* no schedule() */

 /* q.pi_state->owner == current */
 futex_private_hash_put()
 /* return from syscall */
                                              rcuwait_wake_up(&q->requeue_wait)
                                                /* q is gone */

futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before
calling rcuwait_wake_up(). The waiter observes this state in
rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().
Here, the waiter is free leave the syscall before requeue task can
complete the wake.

To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED
case.
This state is only published by requeue_pi_wake_futex(), which saves
q->task before futex_requeue_pi_complete() and wakes the waiter via
wake_up_state().

This wake is intended to wake the waiter from its futex_do_wait() sleep.
If the waiter is still sleeping there, it can not get into the
Q_REQUEUE_PI_WAIT state (and require this removed wake).
Should the waiter be woken up from futex_do_wait() by other means (as in
this example) and sleep in futex_requeue_pi_wakeup_sync() then the
wake_up_state() from requeue_pi_wake_futex() will wake it, too.
Should the waiter task terminate before wake_up_state() had a chance to
wake the task then the task pointer does not become invalid because the
futex_hash_bucket::lock is held and the task pointer is RCU protected.

[bigeasy: Updated comment and commit message]

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.