In the Linux kernel, the following vulnerability has been resolved:
futex: Clear stale exiting pointer in futexlockpi() retry path
Fuzzying/stressing futexes triggered:
WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524
When futexlockpi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'.
After waitforownerexiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futexlockpiatomic() returns a different error, the bogus pointer is passed to waitforowner_exiting().
CPU0 CPU1 CPU2 futexlockpi(uaddr) // acquires the PI futex exit() futexcleanupbegin() futexstate = EXITING; futexlockpi(uaddr) futexlockpiatomic() attachtopiowner() // observes EXITING *exiting = owner; // takes ref return -EBUSY waitforownerexiting(-EBUSY, owner) puttaskstruct(); // drops ref // exiting still points to owner goto retry; futexlockpiatomic() lockpiupdateatomic() cmpxchg(uaddr) *uaddr ^= WAITERS // whatever // value changed return -EAGAIN; waitforownerexiting(-EAGAIN, exiting) // stale WARNON_ONCE(exiting)
Fix this by resetting upon retry, essentially aligning it with requeue_pi.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31555.json"
}