{"id":"CVE-2026-90003","revision":"d791e84520d245229d26e733d4f99ac6","records":[{"revision":"d791e84520d245229d26e733d4f99ac6","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90003","aliases":[],"title":"futex: Prevent rcuwait use-after-free during requeue PI","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter's\nstack. An early wakeup can race with a PI requeue as follows:\n\n waiter requeue task\n ------ ------------\nfutex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n futex_requeue_pi_wakeup_sync()\n Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT\n requeue_pi_wake_futex\n futex_requeue_pi_complete()\n cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED\n rcuwait_wait_event()\n if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)\n break /* no schedule() */\n\n /* q.pi_state->owner == current */\n futex_private_hash_put()\n /* return from syscall */\n rcuwait_wake_up(&q->requeue_wait)\n /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq->task before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]","state":0,"publishedAt":"2026-09-16T10:33:13.42+00:00","modifiedAt":"2026-10-19T08:56:17.256+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"kernel/futex/requeue.c\"\n ],\n \"versions\": [\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"220ee9e04ca3b7f014c000264aa6c884f036c86e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"81aadbd09bf1dcd3238212f336ba699503557ae8\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"244f301759fd34b1dd0b4192ce44f8ef224e027d\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"7d1559126d86be6e4f6a85663dfbfe85caa47e37\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"e4a4ccfa470f910b747b3ee8d18670ed8ac8a236\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"07d91ef510fb16a2e0ca7453222105835b7ba3b8\",\n \"lessThan\": \"a3b8d46fe401cba3a5c46dea610e6eb3dc15370e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"kernel/futex/requeue.c\"\n ],\n \"versions\": [\n {\n \"version\": \"5.15\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"5.15\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.188\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.157\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.110\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.51\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2.5\",\n \"lessThanOrEqual\": \"7.2.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.3\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e","https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8","https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d","https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37","https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236","https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90003","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90003","identifiers":["CVE-2026-90003"]},"retained":false,"historicalAffected":[]}],"coverage":[]}