FKIE_CVE-2026-90003

Vulnerability from fkie_nvd - Published: 2026-09-16 11:17 - Updated: 2026-10-19 09:18
Severity
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report (slab-out-of-bounds) in futex_requeue_pi_complete() invocation of rcuwait_wake_up(). The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's stack. An early wakeup can race with a PI requeue as follows: waiter requeue task ------ ------------ futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue futex_proxy_trylock_atomic() futex_requeue_pi_prepare() Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS * timeout/ signal wakes waiter * futex_requeue_pi_wakeup_sync() Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT requeue_pi_wake_futex futex_requeue_pi_complete() cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED rcuwait_wait_event() if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT) break /* no schedule() */ /* q.pi_state->owner == current */ futex_private_hash_put() /* return from syscall */ rcuwait_wake_up(&q->requeue_wait) /* q is gone */ futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before calling rcuwait_wake_up(). The waiter observes this state in rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event(). Here, the waiter is free leave the syscall before requeue task can complete the wake. To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case. This state is only published by requeue_pi_wake_futex(), which saves q->task before futex_requeue_pi_complete() and wakes the waiter via wake_up_state(). This wake is intended to wake the waiter from its futex_do_wait() sleep. If the waiter is still sleeping there, it can not get into the Q_REQUEUE_PI_WAIT state (and require this removed wake). Should the waiter be woken up from futex_do_wait() by other means (as in this example) and sleep in futex_requeue_pi_wakeup_sync() then the wake_up_state() from requeue_pi_wake_futex() will wake it, too. Should the waiter task terminate before wake_up_state() had a chance to wake the task then the task pointer does not become invalid because the futex_hash_bucket::lock is held and the task pointer is RCU protected. [bigeasy: Updated comment and commit message]
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "kernel/futex/requeue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "220ee9e04ca3b7f014c000264aa6c884f036c86e",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            },
            {
              "lessThan": "81aadbd09bf1dcd3238212f336ba699503557ae8",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            },
            {
              "lessThan": "244f301759fd34b1dd0b4192ce44f8ef224e027d",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            },
            {
              "lessThan": "7d1559126d86be6e4f6a85663dfbfe85caa47e37",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            },
            {
              "lessThan": "e4a4ccfa470f910b747b3ee8d18670ed8ac8a236",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            },
            {
              "lessThan": "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e",
              "status": "affected",
              "version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "kernel/futex/requeue.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter\u0027s\nstack. An early wakeup can race with a PI requeue as follows:\n\n        waiter                          requeue task\n        ------                          ------------\nfutex_wait_requeue_pi()\n  futex_do_wait()\n    schedule()\n                                       futex_requeue\n                                         futex_proxy_trylock_atomic()\n                                           futex_requeue_pi_prepare()\n                                            Q_REQUEUE_PI_NONE -\u003e Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n  futex_requeue_pi_wakeup_sync()\n   Q_REQUEUE_PI_IN_PROGRESS -\u003e Q_REQUEUE_PI_WAIT\n                                           requeue_pi_wake_futex\n                                             futex_requeue_pi_complete()\n                                               cmpxchg Q_REQUEUE_PI_WAIT -\u003e Q_REQUEUE_PI_LOCKED\n    rcuwait_wait_event()\n      if (atomic_read(\u0026q-\u003erequeue_state) != Q_REQUEUE_PI_WAIT)\n       break /* no schedule() */\n\n /* q.pi_state-\u003eowner == current */\n futex_private_hash_put()\n /* return from syscall */\n                                              rcuwait_wake_up(\u0026q-\u003erequeue_wait)\n                                                /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq-\u003etask before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]"
    }
  ],
  "id": "CVE-2026-90003",
  "lastModified": "2026-10-19T09:18:47.943",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-16T11:17:12.810",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.