locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.12 % · percentile 2 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Modified
Description
In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex().
Weaknesses (CWE)
- CWE-476 — NULL Pointer Dereference
References
- https://git.kernel.org/stable/c/bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1
- https://git.kernel.org/stable/c/4ffacf76a457b7ca8ac05f5df8740b0d8f53574a
- https://git.kernel.org/stable/c/4afda3a1da02129568a3a2f1898aa13e6763bcba
- https://git.kernel.org/stable/c/6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48
- https://git.kernel.org/stable/c/5799f9bd7fee40370b93ab1ddf001cdc7017c14d
- https://git.kernel.org/stable/c/a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53
- https://git.kernel.org/stable/c/55363fa0a04524d11efeaadee734d2db1756ed27
- https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-39254
- GCVE · GCVE-0-2026-53163
CERT-FR advisories
- CERTFR-2026-AVI-1385 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1333 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1288 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1286 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1255 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1252 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1231 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1229 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1203 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1202 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1164 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2026-AVI-1162 — Multiples vulnérabilités dans le noyau Linux d'Ubuntu · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0957 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0929 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0862 — Multiples vulnérabilités dans le noyau Linux de Debian LTS · cert.ssi.gouv.fr
- CERTFR-2026-AVI-0855 — Multiples vulnérabilités dans Microsoft Azure Linux · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.1.175 < 6.1.177cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.6.140 < 6.6.144cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.12.86 < 6.12.95cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 6.18.27 < 6.18.36cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 7.0.4 < 7.0.13cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected f3fa3424bceb128d2be4b3745506b22844b87db7 < bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1 ; affected 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd < 4ffacf76a457b7ca8ac05f5df8740b0d8f53574a ; affected d8cce4773c2b23d819baf5abedc62f7b430e8745 < 4afda3a1da02129568a3a2f1898aa13e6763bcba ; affected 8a1fc8d698ac5e5916e3082a0f74450d71f9611f < 6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48 ; affected 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 < 5799f9bd7fee40370b93ab1ddf001cdc7017c14d ; affected 3fb7394a837740770f0d6b4b30567e60786a63f2 < a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53 |
| Linux · Linux | affected 6.1.175 < 6.1.177 ; affected 6.6.140 < 6.6.144 ; affected 6.12.86 < 6.12.95 ; affected 6.18.27 < 6.18.36 ; affected 7.0.4 < 7.0.13 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |