CVE-2026-43499

In the Linux kernel, the following vulnerability has been resolved:

rtmutex: Use waiter::task instead of current in remove_waiter()

removewaiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rtmutexstartproxylock() when invoked from futexrequeue().

In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:

1) the rbtree dequeue happens without waiter::task::pi_lock being held

2) the waiter task's piblockedon state is not cleared, which leaves a dangling pointer primed for UAF around.

3) rtmutexadjustpriochain() operates on the wrong top priority waiter task

Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.

[ tglx: Fixup rtmutexadjustpriochain(), add a comment and amend the changelog ]