CVE-2026-43499— rtmutex: Use waiter::task instead of current in remove_waiter()
Possible ATT&CK Techniques 1AI
T1211 · Exploitation for StealthAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 8a1fc8d698ac5e5916e3082a0f74450d71f9611f | affected |
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3fb7394a837740770f0d6b4b30567e60786a63f2 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 88614876370aac8ad1050ad785a4c095ba17ac11 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 | affected | ||
2.6.39 | affected | ||
< 2.6.39 | unaffected | ||
6.6.140≤ 6.6.* | unaffected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-43499
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
rtmutex: Use waiter::task instead of current in remove_waiter()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rtmutex中remove_waiter函数使用current而非waiter::task，可能导致红黑树出队未持有锁、pi_blocked_on状态未清除以及优先级调整操作错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-43499
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43499
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-43499 (5)
Same Patch Batch · Linux · 2026-05-21 · 8 CVEs total
| CVE-2026-43502 | net/rds: handle zerocopy send cleanup before the message is queued | |
| CVE-2026-43501 | ipv6: rpl: reserve mac_len headroom when recompressed SRH grows | |
| CVE-2026-43498 | accel/ivpu: Disallow re-exporting imported GEM objects | |
| CVE-2026-43497 | fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free | |
| CVE-2026-43496 | net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked | |
| CVE-2026-43495 | net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler | |
| CVE-2026-43494 | net/rds: reset op_nents when zerocopy page pin fails |
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing - CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-trans - CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects
Same vendor: Linux
- CVE-2026-46300
net: skbuff: preserve shared-frag marker during coalescing - CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-trans - CVE-2026-43502
net/rds: handle zerocopy send cleanup before the message is - CVE-2026-43501
ipv6: rpl: reserve mac_len headroom when recompressed SRH gr - CVE-2026-43498
accel/ivpu: Disallow re-exporting imported GEM objects
V. Comments for CVE-2026-43499
No comments yet