CVE-2026-90003
In the Linux kernel, the following vulnerability has been resolved:
futex: Prevent rcuwait use-after-free during requeue PI
On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report (slab-out-of-bounds) in futex_requeue_pi_complete() invocation of rcuwait_wake_up().
The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's stack. An early wakeup can race with a PI requeue as follows:
/* q.pi_state->owner == current */ futex_private_hash_put() /* return from syscall */ rcuwait_wake_up(&q->requeue_wait) /* q is gone */
Leer descripción completaMostrar menos
futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before calling rcuwait_wake_up(). The waiter observes this state in rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event(). Here, the waiter is free leave the syscall before requeue task can complete the wake.
To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case. This state is only published by requeue_pi_wake_futex(), which saves q->task before futex_requeue_pi_complete() and wakes the waiter via wake_up_state().
This wake is intended to wake the waiter from its futex_do_wait() sleep. If the waiter is still sleeping there, it can not get into the Q_REQUEUE_PI_WAIT state (and require this removed wake). Should the waiter be woken up from futex_do_wait() by other means (as in this example) and sleep in futex_requeue_pi_wakeup_sync() then the wake_up_state() from requeue_pi_wake_futex() will wake it, too. Should the waiter task terminate before wake_up_state() had a chance to wake the task then the task pointer does not become invalid because the futex_hash_bucket::lock is held and the task pointer is RCU protected.
[bigeasy: Updated comment and commit message]
Detalles técnicos trazas, registros y código del informe original
waiter requeue task
------ ------------
futex_wait_requeue_pi()
futex_do_wait()
schedule()
futex_requeue
futex_proxy_trylock_atomic()
futex_requeue_pi_prepare()
Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS
* timeout/ signal wakes waiter *
futex_requeue_pi_wakeup_sync()
Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT
requeue_pi_wake_futex
futex_requeue_pi_complete()
cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED
rcuwait_wait_event()
if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)
break /* no schedule() */CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 7.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.16%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 6/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
🎯 Técnicas ATT&CK
Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.
- Explotación
T1068Exploitation for Privilege Escalationprivilege escalation75 % - Impacto principal
T1499.004Application or System Exploitationimpact65 % - Impacto secundario
T1565.001Stored Data Manipulationimpact55 %
Vulnerabilidad de uso después de liberación (use-after-free) en kernel Linux con privilegios locales (PR:L), explotable para escalada T1068. Impacto: DoS por corrupción de memoria (slab-out-of-bounds KASAN) y potencial manipulación de datos en estructuras futex comprometidas.
Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.
🛡️ Mitigaciones ATT&CK que cubren estas técnicas
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
- https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e
- https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d
- https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37
- https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8
- https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e
- https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-90003",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Secondary",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.8,
"attackVector": "LOCAL",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "220ee9e04ca3b7f014c000264aa6c884f036c86e",
"versionType": "git"
},
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "81aadbd09bf1dcd3238212f336ba699503557ae8",
"versionType": "git"
},
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "244f301759fd34b1dd0b4192ce44f8ef224e027d",
"versionType": "git"
},
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "7d1559126d86be6e4f6a85663dfbfe85caa47e37",
"versionType": "git"
},
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "e4a4ccfa470f910b747b3ee8d18670ed8ac8a236",
"versionType": "git"
},
{
"status": "affected",
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
"lessThan": "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e",
"versionType": "git"
}
],
"programFiles": [
"kernel/futex/requeue.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.15"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.15",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.51",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.5",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3-rc2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"kernel/futex/requeue.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-09-16T11:17:12.810",
"references": [
{
"url": "https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter's\nstack. An early wakeup can race with a PI requeue as follows:\n\n waiter requeue task\n ------ ------------\nfutex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n futex_requeue_pi_wakeup_sync()\n Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT\n requeue_pi_wake_futex\n futex_requeue_pi_complete()\n cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED\n rcuwait_wait_event()\n if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)\n break /* no schedule() */\n\n /* q.pi_state->owner == current */\n futex_private_hash_put()\n /* return from syscall */\n rcuwait_wake_up(&q->requeue_wait)\n /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq->task before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]"
}
],
"lastModified": "2026-09-16T15:18:24.143",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}