Executive brief
The Linux kernel's futex (fast userspace mutex) subsystem contains a timing gap during process execution that allows incorrect validation of private futex ownership. When a process calls exec() to load a new binary, a window exists where the kernel's memory address space (mm) check fails before the process's memory context is fully switched, potentially allowing unauthorized futex operations. This could lead to privilege escalation or denial of service in systems relying on futex-based synchronization.
Technical details
The vulnerability is a race condition in the futex priority inheritance (pi) code during exec(). The check for private futexes compares memory address spaces (mm) between waiter and owner, but exec() has a critical gap: between cleanup_robust_list() completion (where exit_state is set to OK) and the actual mm swap, the kernel's validation incorrectly treats a dying mm as valid. The fix involves two state transitions: setting exit_state to FUTEX_STATE_DEAD in futex_exec_release(), then to FUTEX_STATE_OK only after the mm has been switched in futex_exec_done(). This prevents futex operations from succeeding on a task whose mm is about to be freed. The vulnerability affects all Linux kernels with the local task local hash futex infrastructure (from commit 80367ad01d93 onward), and patches are available in mainline and stable kernels.
Affected products
- Linux Linux kernel all versions with local task local hash futex infrastructure (from commit 80367ad01d93 onward)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched