CVE-2026-43499

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> rtmutex: Use waiter::task instead of current in remove_waiter()<br /> <br /> remove_waiter() is used by the slowlock paths, but it is also used for<br /> proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from<br /> futex_requeue().<br /> <br /> In the latter case waiter::task is not current, but remove_waiter()<br /> operates on current for the dequeue operation. That results in several<br /> problems:<br /> <br /> 1) the rbtree dequeue happens without waiter::task::pi_lock being held<br /> <br /> 2) the waiter task&amp;#39;s pi_blocked_on state is not cleared, which leaves a<br /> dangling pointer primed for UAF around.<br /> <br /> 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter<br /> task<br /> <br /> Use waiter::task instead of current in all related operations in<br /> remove_waiter() to cure those problems.<br /> <br /> [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the<br /> changelog ]