Executive brief
A race condition in the Linux kernel's futex (fast userspace mutex) implementation can cause a use-after-free memory error on systems with PREEMPT_RT enabled. This occurs during Priority Inheritance requeue operations when a waiter is woken up before the requeue task completes, potentially allowing an attacker to crash the system or execute arbitrary code.
Technical details
This is a use-after-free vulnerability in the Linux kernel's futex_requeue_pi_complete() function on PREEMPT_RT systems. The vulnerability occurs when FUTEX_CMP_REQUEUE_PI triggers a race between a waiter waking early (via timeout or signal) and a requeue task performing PI (Priority Inheritance) requeue operations. The futex_q structure is allocated on the waiter's stack, and the requeue task calls rcuwait_wake_up() on this structure after the waiter has already left the syscall, causing a slab-out-of-bounds access. The fix prevents rcuwait_wake_up() from being called in the Q_REQUEUE_PI_LOCKED state, as the waiter is already woken by wake_up_state() from requeue_pi_wake_futex(). The vulnerability requires PREEMPT_RT to be enabled and FUTEX_CMP_REQUEUE_PI operations to be in flight; a patch is available in the Linux kernel.
Affected products
- Linux Linux kernel versions with PREEMPT_RT enabled (prior to fix)
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in Linux kernel via futex requeue PI race condition patch