Executive brief
A vulnerability in the Linux kernel's memory synchronization mechanism (futex) can cause the entire system to crash. This occurs when a specific type of lock request is handled incorrectly, leading to a kernel failure. An attacker or a malfunctioning local application could exploit this to cause a denial-of-service, disrupting business operations and system availability.
Technical details
A NULL pointer dereference exists in the Linux kernel's futex/requeue.c component. When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before the waiter->task pointer is initialized. A subsequent call to remove_waiter() in rt_mutex_start_proxy_lock() then attempts to dereference this NULL pointer, resulting in a kernel panic. The fix introduces a self-deadlock check for non-top waiters to prevent the uninitialized pointer access. This is a local vulnerability requiring the ability to execute code to trigger the specific futex operations.
Affected products
- Linux Linux 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4
Timeline
- 2026-06-02: other: Vulnerability fixed in upstream commits
- 2026-06-25: advisory: NVD advisory published