Executive brief
The Linux kernel contains a race condition in the futex (fast userspace mutex) subsystem that can cause a process to hang indefinitely during private hash resizing operations. This can lead to system hangs where processes become unresponsive and the hung-task detector triggers, potentially requiring manual intervention to recover.
Technical details
A race condition exists in futex_pivot_pending() during private hash resize operations. The vulnerability occurs because state reads (hash_new and hash) are not serialized, allowing a task to observe an inconsistent state: hash_new in pre-pivot state and hash in post-pivot state. This causes futex_pivot_pending() to incorrectly return false after a pivot has completed, leaving the waiting task blocked in uninterruptible sleep indefinitely. The fix serializes state reads using futex_mm_phash::lock to guarantee atomic observation of hash_new and hash, eliminating the race condition.
Affected products
- Linux Linux kernel Linux kernel (version range not specified)
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Fix resolves race by serializing state reads using futex_mm_phash::lock