Executive brief
The Linux kernel's futex (fast userspace mutex) mechanism contains a race condition in robust lock cleanup that can cause waiting processes to sleep indefinitely when a lock is re-acquired during exit handling. This affects systems relying on robust futexes for inter-process synchronization and could lead to application hangs or deadlocks in concurrent workloads.
Technical details
The vulnerability is a race condition in the robust futex unlock and exit sequence. When a robust futex is unlocked, it stores zero and wakes a single waiter; that waiter must either acquire the futex or re-arm the FUTEX_WAITERS bit before sleeping again. If a third task fast-path acquires the futex before robust exit processing, and the original woken waiter is killed, the FUTEX_WAITERS notification is lost: the new owner sees no waiters and wakes nobody, leaving other waiters sleeping forever behind a free futex. The fix augments robust list exit processing to perform an extra wakeup if the futex is owned by another thread but FUTEX_WAITERS is not set, addressing the consistency issue in the protocol implementation.
Affected products
- Linux Linux kernel kernel versions prior to the fix (exact versions not specified)
Timeline
- 2026-08-22: disclosed