CVE-2026-53166
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk3th percentile — higher than 3% of all known CVEs
Summary
A vulnerability in the Linux kernel futex/requeue mechanism can cause a NULL pointer dereference during FUTEX_CMP_REQUEUE_PI operation. When a non-top waiter that already owns the target PI futex is requeued, the error -EDEADLK occurs and remove_waiter() tries to access uninitialized waiter->task, leading to a kernel crash.
Risk Assessment
A local attacker could exploit this vulnerability to trigger a kernel panic (DoS), causing system unavailability. The attack requires user-space code execution privileges.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit adding self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock()).
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task. The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences the NULL waiter->task, causing a kernel crash. Add a self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock(), analogous to the top-waiter check in futex_lock_pi_atomic().