PT-2026-42456 · Linux+1 · Linux Kernel+1
CVSS v4.0
8.5
High
| Vector | AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 2.6.39 through 7.0.x
Description
A use-after-free (UAF) issue exists in the Linux kernel's real-time mutex (rtmutex) locking code used by the futex priority inheritance mechanism. The issue occurs within the
remove waiter() function, which is used by slowlock paths and for proxy-lock rollback in rt mutex start proxy lock() when called from futex requeue(). In the latter scenario, the function incorrectly operates on the current task instead of the waiter::task, leading to several failures: the rbtree dequeue occurs without the waiter::task::pi lock being held, the pi blocked on state of the waiter task is not cleared (leaving a dangling pointer), and the rt mutex adjust prio chain() function operates on the wrong top priority waiter task.An unprivileged local attacker can exploit this to hijack the freed kernel pointer, redirect kernel execution, and gain root privileges or escape containers to compromise the host. The issue is present if the
CONFIG FUTEX PI parameter is enabled, which is the default for most general-purpose kernels.Recommendations
Update the Linux kernel to version 7.1 or later.
Enable the
RANDOMIZE KSTACK OFFSET protection feature to reduce the reliability of exploitation.
Restrict unauthorized local access to the system to minimize the risk of exploitation.Exploit
Fix
LPE
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel
Rocky Linux