Executive brief
A vulnerability was identified in the Linux kernel's locking mechanism that could allow a local user to crash the system. The issue occurs when the system attempts to manage internal locks during specific resource requests, leading to a kernel panic. This primarily impacts system availability and could be used to disrupt operations or cause a denial-of-service on affected servers.
Technical details
A null pointer dereference exists in kernel/locking/rtmutex.c within the remove_waiter() function. The vulnerability is triggered via the FUTEX_CMP_REQUEUE_PI operation when task_blocks_on_rt_mutex() detects a deadlock but fails to arm the waiter, leaving waiter->task as NULL. Subsequent calls to remove_waiter() attempt to access this null task pointer, resulting in a kernel oops/panic. Additionally, rt_mutex_start_proxy_lock() incorrectly called remove_waiter() even upon successful lock acquisition. The fix introduces a check to skip remove_waiter() if the waiter was never enqueued and tightens return value handling in the proxy lock wrapper.
Affected products
- Linux Linux Kernel 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4
Timeline
- 2026-05-07: other: Patch authored
- 2026-06-25: disclosed: CVE published
- 2026-06-25: advisory