In the Linux kernel, the following vulnerability has been resolved:
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI:
KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0
task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal.
Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex().
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-develUpgrade perf6.18-debuginfoUpgrade kernel6.18Upgrade kernel6.18-debuginfo-common-aarch64Upgrade bpftool6.12-debuginfoUpgrade bpftool6.12Upgrade bpftool6.18-debuginfoUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade perf6.12-debuginfoUpgrade kernel6.18-headersUpgrade kernel6.12Upgrade kernel6.18-modules-extraUpgrade kernel6.18-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.18-toolsUpgrade kernel6.12-modules-extraUpgrade python3-perf6.12Upgrade python3-perf6.12-debuginfoUpgrade perf6.12Upgrade kernel6.18-debuginfo-common-x86_64Upgrade kernel-livepatch-6.12.94-123.180Upgrade kernel6.12-modules-extra-commonUpgrade bpftool6.18Upgrade python3-perf6.18Upgrade perf6.18Upgrade microvm-kernel6.18Upgrade python3-perf6.18-debuginfoUpgrade kernel6.18-tools-develUpgrade kernel6.18-modules-extra-commonUpgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-headersUpgrade kernel6.18-develUpgrade kernel6.12-tools-develUpgrade kernel6.18-tools-debuginfoUpgrade kernel6.12-debuginfoUpgrade kernel-livepatch-6.18.36-69.134 | Jul 21, 2026 | Jun 25, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Jul 19, 2026 | Jul 19, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Jun 25, 2026 |
| Ubuntu | — | Upgrade linux-image-7.0.0-31-realtime-64kUpgrade linux-image-7.0.0-1011-gcp-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-generic-64kUpgrade linux-image-gke-64kUpgrade linux-image-azure-lts-26.04Upgrade linux-image-7.0.0-2018-nvidia-bos-64kUpgrade linux-image-7.0.0-1018-nvidiaUpgrade linux-image-oracle-64k-7.0Upgrade linux-image-7.0.0-1013-ibmUpgrade linux-image-nvidia-7.0Upgrade linux-image-nvidia-bos-7.0Upgrade linux-image-generic-hwe-24.04Upgrade linux-image-oem-26.04Upgrade linux-image-virtualUpgrade linux-image-virtual-hwe-26.04Upgrade linux-image-7.0.0-1011-oracleUpgrade linux-image-oem-26.04bUpgrade linux-image-7.0.0-1011-gcpUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-gcpUpgrade linux-image-7.0.0-1012-aws-64kUpgrade linux-image-7.0.0-1006-gkeUpgrade linux-image-7.0.0-1006-gke-64kUpgrade linux-image-realtime-hwe-26.04Upgrade linux-image-nvidia-64k-7.0Upgrade linux-image-azure-7.0Upgrade linux-image-ibmUpgrade linux-image-nvidia-bos-64k-7.0Upgrade linux-image-gcp-7.0Upgrade linux-image-virtual-7.0Upgrade linux-image-nvidiaUpgrade linux-image-genericUpgrade linux-image-ibm-7.0Upgrade linux-image-oracle-7.0Upgrade linux-image-oracle-64kUpgrade linux-image-raspi-realtimeUpgrade linux-image-7.0.0-31-genericUpgrade linux-image-nvidia-bosUpgrade linux-image-gke-7.0Upgrade linux-image-aws-64k-7.0Upgrade linux-image-gcp-64kUpgrade linux-image-nvidia-bos-64kUpgrade linux-image-gke-64k-hwe-26.04Upgrade linux-image-gke-hwe-26.04Upgrade linux-image-generic-hwe-26.04Upgrade linux-image-gcp-64k-7.0Upgrade linux-image-7.0.0-1019-raspiUpgrade linux-image-7.0.0-1011-oracle-64kUpgrade linux-image-7.0.0-1012-awsUpgrade linux-image-7.0.0-1019-raspi-realtimeUpgrade linux-image-realtime-7.0Upgrade linux-image-aws-64kUpgrade linux-image-7.0.0-2018-nvidia-bosUpgrade linux-image-7.0.0-1013-oemUpgrade linux-image-realtime-64k-hwe-26.04Upgrade linux-image-7.0.0-31-generic-64kUpgrade linux-image-raspi-7.0Upgrade linux-image-gke-64k-7.0Upgrade linux-image-nvidia-64k-hwe-26.04Upgrade linux-image-generic-64k-7.0Upgrade linux-image-azureUpgrade linux-image-nvidia-hwe-26.04Upgrade linux-image-7.0.0-1018-nvidia-64kUpgrade linux-image-gkeUpgrade linux-image-realtime-64kUpgrade linux-image-generic-7.0Upgrade linux-image-7.0.0-31-realtimeUpgrade linux-image-7.0.0-1014-azureUpgrade linux-image-oracleUpgrade linux-image-generic-64k-hwe-26.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-aws-7.0Upgrade linux-image-awsUpgrade linux-image-oem-26.04aUpgrade linux-image-realtimeUpgrade linux-image-raspiUpgrade linux-image-oem-7.0Upgrade linux-image-realtime-64k-7.0Upgrade linux-image-raspi-realtime-7.0 | Sep 14, 2026 | Sep 7, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jul 27, 2026 | Jun 25, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub