Tglx

**Name of the Vulnerable Software and Affected Versions** Linux kernel versions 2.6.39 through 7.0 **Description** A use-after-free issue exists in the Linux kernel's futex locking subsystem, specifically within the real-time mutex (rtmutex) code used by the priority inheritance mechanism. The issue occurs in the `remove waiter()` function, which is used by slowlock paths and for proxy-lock rollback in `rt mutex start proxy lock()` when called from `futex requeue()`. In the latter case, the function incorrectly operates on the `current` task instead of the `waiter::task`, leading to several problems: the rbtree dequeue occurs without the `waiter::task::pi lock` being held, the `pi blocked on` state of the waiter task is not cleared (leaving a dangling pointer), and the `rt mutex adjust prio chain()` function operates on the wrong top priority waiter task. This flaw allows a locally authenticated, unprivileged user to hijack a freed kernel pointer to gain full root privileges and escape containers to compromise the host system. The issue is present if the `CONFIG FUTEX PI` parameter is enabled, which is the default for most general-purpose Linux kernels. Real-world exploitation has been reported with a success rate of approximately 97%, allowing root access in about five seconds. **Recommendations** Update the Linux kernel to version 7.1 or later. As a temporary mitigation, enable the `RANDOMIZE KSTACK OFFSET` kernel protection feature to reduce the reliability of exploitation.