CVE-2026-90003 in Linux
Summary
by MITRE • 09/16/2026
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent rcuwait use-after-free during requeue PI
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report (slab-out-of-bounds) in futex_requeue_pi_complete() invocation of rcuwait_wake_up().
The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's stack. An early wakeup can race with a PI requeue as follows:
waiter requeue task ------ ------------ futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue futex_proxy_trylock_atomic() futex_requeue_pi_prepare() Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS * timeout/ signal wakes waiter * futex_requeue_pi_wakeup_sync() Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT requeue_pi_wake_futex futex_requeue_pi_complete() cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED rcuwait_wait_event() if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT) break /* no schedule() */
/* q.pi_state->owner == current */ futex_private_hash_put() /* return from syscall */ rcuwait_wake_up(&q->requeue_wait) /* q is gone */
futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before calling rcuwait_wake_up(). The waiter observes this state in rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event(). Here, the waiter is free leave the syscall before requeue task can complete the wake.
To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case. This state is only published by requeue_pi_wake_futex(), which saves q->task before futex_requeue_pi_complete() and wakes the waiter via wake_up_state().
This wake is intended to wake the waiter from its futex_do_wait() sleep. If the waiter is still sleeping there, it can not get into the Q_REQUEUE_PI_WAIT state (and require this removed wake). Should the waiter be woken up from futex_do_wait() by other means (as in this example) and sleep in futex_requeue_pi_wakeup_sync() then the wake_up_state() from requeue_pi_wake_futex() will wake it, too. Should the waiter task terminate before wake_up_state() had a chance to wake the task then the task pointer does not become invalid because the futex_hash_bucket::lock is held and the task pointer is RCU protected.
[bigeasy: Updated comment and commit message]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/16/2026
The Linux kernel contains a critical concurrency vulnerability within the futex implementation, specifically affecting the FUTEX_CMP_REQUEUE_PI operation on PREEMPT_RT configurations. This flaw manifests as a slab-out-of-bounds use-after-free error detected by Kernel Address Sanitizer (KASAN) during the invocation of rcuwait_wake_up() in the futex_requeue_pi_complete function. The root cause lies in a race condition between an early wakeup event and a priority inheritance requeue operation, exploiting the fact that the futex_q structure is allocated on the waiter's stack rather than dynamically from a slab cache with independent lifetime management. When a task waits for a futex using FUTEX_WAIT_REQUEUE_PI, it enters a sleep state while potentially holding resources or references to its own stack-allocated queue structures.
The vulnerability arises when two distinct execution paths interact unsafely: the waiter thread attempting to acquire the lock and the requeue task attempting to transfer ownership of that lock to another process. The sequence begins with futex_wait_requeue_pi() initiating a wait, which may be interrupted by an early wakeup due to timeout or signal delivery. Simultaneously, a separate requeue task executes futex_do_wait(), followed by futex_requeue and subsequent preparation steps like futex_proxy_trylock_atomic(). During this process, the state of the queue transitions through Q_REQUEUE_PI_NONE to Q_REQUEUE_PI_IN_PROGRESS. If the waiter is woken up during this window, it may proceed to call rcuwait_wake_up() after observing a specific state change from Q_REQUEUE_PI_WAIT to Q_REQUEUE_PI_LOCKED in futex_requeue_pi_complete(). However, because the waiter has already returned from its initial sleep and potentially exited the syscall context or is about to do so, the queue structure q may no longer be valid memory.
This race condition allows the requeue task to access a freed stack frame when it calls rcuwait_wake_up(&q->requeue_wait). The futex_requeue_pi_complete function publishes the Q_REQUEUE_PI_LOCKED state before invoking the wake-up routine, but if the waiter has already left its waiting loop due to an external wakeup signal, it will not schedule itself back into a sleeping state that would keep the queue alive. Consequently, the requeue task dereferences memory that belongs to the returning waiter's stack frame, leading to undefined behavior and potential kernel crashes or data corruption. This scenario highlights a fundamental flaw in assuming that the presence of a lock implies the validity of associated wait structures across different execution contexts without explicit synchronization barriers for lifetime management.
The resolution involves modifying futex_requeue_pi_complete() to skip the rcuwait_wake_up call when the state is Q_REQUEUE_PI_LOCKED. This logic relies on the fact that this specific state transition is exclusively published by requeue_pi_wake_futex, which safely saves q->task before calling wake_up_state(). The design ensures that if the waiter is still sleeping in futex_do_wait(), it cannot have entered the Q_REQUEUE_PI_WAIT state requiring the removed wake. If the waiter was woken by other means and subsequently sleeps in futex_requeue_pi_wakeup_sync, the alternative wake-up mechanism via requeue_pi_wake_futex will correctly target it. Furthermore, if the task terminates before the final wake occurs, the RCU protection on the task pointer within the futex_hash_bucket ensures that no invalid memory access happens because the lock is held during these critical sections.
From a security perspective, this vulnerability aligns with CWE-416: Use After Free, as it involves accessing memory after it has been made available for reuse by another part of the system. In terms of MITRE ATT&CK mapping, this falls under Tactic Execution and Defense Evasion, specifically relating to techniques that exploit race conditions in operating systems to cause denial of service or potentially escalate privileges if an attacker can trigger such a state reliably. The impact is primarily stability-related, leading to kernel panics or silent corruption, but the underlying mechanism demonstrates how complex locking protocols like Priority Inheritance (PI) require rigorous synchronization guarantees to prevent lifetime mismatches between waiters and requeue operations.
Mitigation strategies involve applying the upstream Linux kernel patch that addresses this race condition by adjusting the wake-up logic in futex_requeue_pi_complete(). System administrators should ensure their kernels are updated to versions where this fix is included, particularly those running PREEMPT_RT patches which expose this specific timing window more readily due to real-time scheduling characteristics. For developers integrating custom futex operations or debugging similar concurrency issues, it is essential to verify that all references to wait structures are protected by appropriate RCU read-side critical sections or lock-held guarantees until the structure's lifetime is definitively over. Regular auditing of kernel code for stack-allocated data structures involved in asynchronous wake-up sequences can help prevent analogous vulnerabilities in future developments.