PT-2026-85618 · Linux · Linux
CVE-2026-80777
·
Publicado
2026-09-04
·
Atualizado
2026-09-04
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
futex/pi: Plug private futex exec() race
The check for private futexes whether the waiter's mm, which is stored in
the futex key and copied into the pi state, is the same as the owner's mm
is not sufficient for exec(). exec() has a gap where the mm check fails to
give the correct answer:
exec()
...
exec release mm()
futex exec release()
tsk::futex::exit state = EXITING;
cleanup robust list();
- tsk::futex::exit state = OK; ... old mm = tsk::mm;
- tsk::mm = ->mm;
Between #1 and #2 the check for the mm is wrong as that mm is about to be
swapped out and eventually freed.
Plug this gap by:
-
Setting tsk::futex::exit state to FUTEX STATE DEAD in futex exec release()
-
Setting tsk::futex::exit state to FUTEX STATE OK after the mm has been switched.
From a futex point of view the task is dead after it finished the robust
list cleanup up to the point where it sets the state to OK again.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux