Executive brief
A race condition in the Linux kernel's futex system—a mechanism used for process synchronization—could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue occurs when a process is being moved between wait queues and is interrupted by a signal or timeout, leading to a 'use-after-free' scenario where the system tries to access memory that has already been released. This primarily impacts system stability and availability.
Technical details
A use-after-free vulnerability exists in kernel/futex/requeue.c due to a race condition between futex_wait_requeue_pi() and futex_requeue(). When a task (T1) waiting on a requeue-PI operation is woken by a signal or timeout, it may exit and invalidate its stack-allocated futex_q structure before a second task (T2) completes the wake_up_state() call. The root cause is that futex_requeue_pi_complete() signals the locked state to the waiter before the waker has finished accessing the task structure. The fix involves using READ_ONCE to capture the task pointer before updating the requeue state, ensuring the task_struct remains valid during the subsequent wakeup call even if the original task terminates.
Affected products
- Linux Linux Kernel Fixed in 6.1.113, 6.6.54, 6.10.13, 6.11.2, 6.12-rc1
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2025-09-10: patched: Initial fix authored by Sebastian Andrzej Siewior
- 2025-10-15: disclosed: CVE published
References
- https://git.kernel.org/stable/c/348736955ed6ca6e99ca24b93b1d3fbfe352c181
- https://git.kernel.org/stable/c/a170b9c0dde83312b8b58ccc91509c7c15711641
- https://git.kernel.org/stable/c/b549113738e8c751b613118032a724b772aa83f2
- https://git.kernel.org/stable/c/cb5d19a61274b51b49601214a87af573b43d60fa
- https://git.kernel.org/stable/c/d824b2dbdcfe3c390278dd9652ea526168ef6850
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html
- https://cert-portal.siemens.com/productcert/html/ssa-082556.html