{"id":"CVE-2026-80777","revision":"b3eb8c8cd1bb43a790930a6e5f42e7d0","records":[{"revision":"b3eb8c8cd1bb43a790930a6e5f42e7d0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-80777","aliases":[],"title":"futex/pi: Plug private futex exec() race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner's mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n  exec()\n  ...\n    exec_release_mm()\n      futex_exec_release()\n        tsk::futex::exit_state = EXITING;\n        cleanup_robust_list();\n1)      tsk::futex::exit_state = OK;\n    ...\n    old_mm = tsk::mm;\n2)  tsk::mm = ->mm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n  1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n     futex_exec_release()\n\n  2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n     the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again.","state":0,"publishedAt":"2026-09-04T15:12:49.215+00:00","modifiedAt":"2026-10-19T08:43:32.707+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/exec.c\",\n                        \"include/linux/futex.h\",\n                        \"kernel/futex/core.c\",\n                        \"kernel/futex/pi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"80367ad01d93ac781b0e1df246edaf006928002f\",\n                            \"lessThan\": \"fdf538b2e69653ff740e84042245018e5680cd7b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"80367ad01d93ac781b0e1df246edaf006928002f\",\n                            \"lessThan\": \"0478bc6bf197629fea0331d65b39eeea043c6cf0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"80367ad01d93ac781b0e1df246edaf006928002f\",\n                            \"lessThan\": \"d7944cee62ec6cca1c90780a766960a57d3b4bb8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"80367ad01d93ac781b0e1df246edaf006928002f\",\n                            \"lessThan\": \"c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/exec.c\",\n                        \"include/linux/futex.h\",\n                        \"kernel/futex/core.c\",\n                        \"kernel/futex/pi.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.47\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.11\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.1\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b","https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0","https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8","https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-80777","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-80777","identifiers":["CVE-2026-80777"]},"retained":false,"historicalAffected":[]}],"coverage":[]}