{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43499", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.014Z", "datePublished": "2026-05-21T12:17:49.281Z", "dateUpdated": "2026-09-08T08:48:56.857Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:22.054Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable code is reached through the futex(2) syscall (FUTEX_CMP_REQUEUE_PI \u2192 futex_requeue \u2192 rt_mutex_start_proxy_lock), which requires local access to issue syscalls and is not reachable over any network.\nAC:L - The attacker controls all the threads and PI-futexes involved and can deterministically construct the deadlock-detection error that drives the proxy-lock rollback into remove_waiter(); the resulting UAF/corruption is reliably triggerable without depending on conditions outside the attacker's control.\nPR:L - Any basic unprivileged local user can call futex() with FUTEX_CMP_REQUEUE_PI \u2014 no capabilities, root, or namespaces are required.\nUI:N - The bug is triggered entirely by the attacker's own threads and syscalls; no action by any other user is needed.\nS:U - The corruption is confined to kernel memory within the same security authority; it is a standard local kernel privilege issue with no cross-boundary (VM/IOMMU) escape.\nC:H - The dangling pi_blocked_on pointer and rbtree dequeue under the wrong pi_lock give a use-after-free over reclaimed stack memory, which can be leveraged to read controlled kernel memory contents.\nI:H - The UAF and unsynchronized rbtree manipulation provide a write primitive into kernel data structures, enabling memory corruption exploitable for control-flow hijacking and privilege escalation.\nA:H - The dangling pointer dereference and PI-chain corruption readily cause kernel oops/panic, so availability impact is high."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/locking/rtmutex.c"], "versions": [{"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "f3fa3424bceb128d2be4b3745506b22844b87db7", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "d8cce4773c2b23d819baf5abedc62f7b430e8745", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "8a1fc8d698ac5e5916e3082a0f74450d71f9611f", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "6d52dfcb2a5db86e346cf51f8fcf2071b8085166", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "3fb7394a837740770f0d6b4b30567e60786a63f2", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "88614876370aac8ad1050ad785a4c095ba17ac11", "status": "affected", "versionType": "git"}, {"version": "8161239a8bcce9ad6b537c04a1fa3b5c68bae693", "lessThan": "3bfdc63936dd4773109b7b8c280c0f3b5ae7d349", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/locking/rtmutex.c"], "versions": [{"version": "2.6.39", "status": "affected"}, {"version": "0", "lessThan": "2.6.39", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.86", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.27", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.4", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.12.86"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "6.18.27"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.0.4"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.39", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7"}, {"url": "https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd"}, {"url": "https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745"}, {"url": "https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f"}, {"url": "https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166"}, {"url": "https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2"}, {"url": "https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11"}, {"url": "https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349"}], "title": "rtmutex: Use waiter::task instead of current in remove_waiter()", "x_generator": {"engine": "bippy-1.2.0"}, "x_gcve": [{"vulnId": "CVE-2026-43499", "recordType": "advisory"}]}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://www.openwall.com/lists/oss-security/2026/07/08/12"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-08T22:22:10.721Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-416", "lang": "en", "description": "CWE-416 Use After Free"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-22T03:55:28.271423Z", "id": "CVE-2026-43499", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-26T19:01:26.917Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-09-08T08:48:56.857Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Siemens", "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP", "versions": [{"status": "affected", "version": "V3.1.6", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"}]}]}, "vulnerability-lookup:meta": {"epss": {"cve": "CVE-2026-43499", "date": "2026-09-28", "epss": "0.00278", "percentile": "0.18137"}, "microsoft_vex": {"current_release_date": "2026-06-09T14:40:06.000Z", "cve": "CVE-2026-43499", "id": "msrc_CVE-2026-43499", "initial_release_date": "2026-05-02T00:00:00.000Z", "product_status:fixed": "1", "product_status:known_affected": "1", "source": "Microsoft CSAF VEX", "status": "final", "title": "rtmutex: Use waiter::task instead of current in remove_waiter()", "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-43499.json", "version": "2"}, "nvd": "{\"cve\":{\"id\":\"CVE-2026-43499\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-21T13:16:19.300\",\"lastModified\":\"2026-09-08T09:18:05.213\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrtmutex: Use waiter::task instead of current in remove_waiter()\\n\\nremove_waiter() is used by the slowlock paths, but it is also used for\\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\\nfutex_requeue().\\n\\nIn the latter case waiter::task is not current, but remove_waiter()\\noperates on current for the dequeue operation. That results in several\\nproblems:\\n\\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\\n\\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\\n     dangling pointer primed for UAF around.\\n\\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\\n     task\\n\\nUse waiter::task instead of current in all related operations in\\nremove_waiter() to cure those problems.\\n\\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\\n  \\tchangelog ]\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nrtmutex: Usar waiter::task en lugar de current en remove_waiter()\\n\\nremove_waiter() es usado por las rutas de slowlock, pero tambi\u00e9n es usado para la reversi\u00f3n de bloqueo de proxy en rt_mutex_start_proxy_lock() cuando es invocado desde futex_requeue().\\n\\nEn este \u00faltimo caso, waiter::task no es current, pero remove_waiter() opera en current para la operaci\u00f3n de desencolado. Eso resulta en varios problemas:\\n\\n  1) el desencolado de rbtree ocurre sin que waiter::task::pi_lock est\u00e9 retenido\\n\\n  2) el estado pi_blocked_on de la tarea de espera no se borra, lo que deja un puntero colgante preparado para UAF.\\n\\n  3) rt_mutex_adjust_prio_chain() opera en la tarea de espera de m\u00e1xima prioridad incorrecta\\n\\nUsar waiter::task en lugar de current en todas las operaciones relacionadas en remove_waiter() para solucionar esos problemas.\\n\\n[ tglx: Corregir rt_mutex_adjust_prio_chain(), a\u00f1adir un comentario y modificar el registro de cambios ]\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"kernel/locking/rtmutex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"f3fa3424bceb128d2be4b3745506b22844b87db7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"d8cce4773c2b23d819baf5abedc62f7b430e8745\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"8a1fc8d698ac5e5916e3082a0f74450d71f9611f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"6d52dfcb2a5db86e346cf51f8fcf2071b8085166\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"3fb7394a837740770f0d6b4b30567e60786a63f2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"88614876370aac8ad1050ad785a4c095ba17ac11\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\",\"lessThan\":\"3bfdc63936dd4773109b7b8c280c0f3b5ae7d349\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"kernel/locking/rtmutex.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.39\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.39\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.175\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.140\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.86\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.27\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.4\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-22T03:55:28.271423Z\",\"id\":\"CVE-2026-43499\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.39\",\"versionEndExcluding\":\"6.1.175\",\"matchCriteriaId\":\"0C6D7D14-6525-4171-992F-7F8ADC8215B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.140\",\"matchCriteriaId\":\"A1A92866-F406-43B5-B2D1-CFC274753E9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.86\",\"matchCriteriaId\":\"55DA1C62-9991-451E-B8A8-E0004E00F789\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.27\",\"matchCriteriaId\":\"A10AC84F-C058-47D5-85B4-E6E51A613B74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.0.4\",\"matchCriteriaId\":\"CDB78D6D-22C3-4154-B0D0-94AF1CE5C2E3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2026/07/08/12\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}", "redhat_vex": {"aggregate_severity": "Important", "current_release_date": "2026-09-08T18:10:29+00:00", "cve": "CVE-2026-43499", "id": "CVE-2026-43499", "initial_release_date": "2026-05-21T00:00:00+00:00", "product_status:fixed": "2376", "product_status:known_affected": "22", "source": "Red Hat CSAF VEX", "status": "final", "title": "kernel: rtmutex: Use waiter::task instead of current in remove_waiter()", "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43499.json", "version": "3"}, "vulnrichment": {"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"http://www.openwall.com/lists/oss-security/2026/07/08/12\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2026-07-08T22:22:10.721Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-43499\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-22T03:55:28.271423Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-416\", \"description\": \"CWE-416 Use After Free\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-26T19:01:22.891Z\"}}], \"cna\": {\"title\": \"rtmutex: Use waiter::task instead of current in remove_waiter()\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The vulnerable code is reached through the futex(2) syscall (FUTEX_CMP_REQUEUE_PI \\u2192 futex_requeue \\u2192 rt_mutex_start_proxy_lock), which requires local access to issue syscalls and is not reachable over any network.\\nAC:L - The attacker controls all the threads and PI-futexes involved and can deterministically construct the deadlock-detection error that drives the proxy-lock rollback into remove_waiter(); the resulting UAF/corruption is reliably triggerable without depending on conditions outside the attacker's control.\\nPR:L - Any basic unprivileged local user can call futex() with FUTEX_CMP_REQUEUE_PI \\u2014 no capabilities, root, or namespaces are required.\\nUI:N - The bug is triggered entirely by the attacker's own threads and syscalls; no action by any other user is needed.\\nS:U - The corruption is confined to kernel memory within the same security authority; it is a standard local kernel privilege issue with no cross-boundary (VM/IOMMU) escape.\\nC:H - The dangling pi_blocked_on pointer and rbtree dequeue under the wrong pi_lock give a use-after-free over reclaimed stack memory, which can be leveraged to read controlled kernel memory contents.\\nI:H - The UAF and unsynchronized rbtree manipulation provide a write primitive into kernel data structures, enabling memory corruption exploitable for control-flow hijacking and privilege escalation.\\nA:H - The dangling pointer dereference and PI-chain corruption readily cause kernel oops/panic, so availability impact is high.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"f3fa3424bceb128d2be4b3745506b22844b87db7\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"d8cce4773c2b23d819baf5abedc62f7b430e8745\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"8a1fc8d698ac5e5916e3082a0f74450d71f9611f\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"6d52dfcb2a5db86e346cf51f8fcf2071b8085166\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"3fb7394a837740770f0d6b4b30567e60786a63f2\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"88614876370aac8ad1050ad785a4c095ba17ac11\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"8161239a8bcce9ad6b537c04a1fa3b5c68bae693\", \"lessThan\": \"3bfdc63936dd4773109b7b8c280c0f3b5ae7d349\", \"versionType\": \"git\"}], \"programFiles\": [\"kernel/locking/rtmutex.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.39\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.39\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.10.261\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.212\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.175\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.140\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.12.86\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.12.*\"}, {\"status\": \"unaffected\", \"version\": \"6.18.27\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.18.*\"}, {\"status\": \"unaffected\", \"version\": \"7.0.4\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"7.0.*\"}, {\"status\": \"unaffected\", \"version\": \"7.1\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"kernel/locking/rtmutex.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7\"}, {\"url\": \"https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd\"}, {\"url\": \"https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745\"}, {\"url\": \"https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f\"}, {\"url\": \"https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166\"}, {\"url\": \"https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2\"}, {\"url\": \"https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11\"}, {\"url\": \"https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nrtmutex: Use waiter::task instead of current in remove_waiter()\\n\\nremove_waiter() is used by the slowlock paths, but it is also used for\\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\\nfutex_requeue().\\n\\nIn the latter case waiter::task is not current, but remove_waiter()\\noperates on current for the dequeue operation. That results in several\\nproblems:\\n\\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\\n\\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\\n     dangling pointer primed for UAF around.\\n\\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\\n     task\\n\\nUse waiter::task instead of current in all related operations in\\nremove_waiter() to cure those problems.\\n\\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\\n  \\tchangelog ]\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.261\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.212\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.175\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.140\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.12.86\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.18.27\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.0.4\", \"versionStartIncluding\": \"2.6.39\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"7.1\", \"versionStartIncluding\": \"2.6.39\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T12:28:22.054Z\"}}}", "cveMetadata": "{\"cveId\": \"CVE-2026-43499\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-26T19:01:26.917Z\", \"dateReserved\": \"2026-05-01T14:12:56.014Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2026-05-21T12:17:49.281Z\", \"assignerShortName\": \"Linux\"}", "dataType": "CVE_RECORD", "dataVersion": "5.2"}}}