CVE-2026-43499

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.39 through 7.0

Description A use-after-free issue exists in the Linux kernel's futex locking subsystem, specifically within the real-time mutex (rtmutex) code used by the priority inheritance mechanism. The issue occurs in the remove waiter() function, which is used by slowlock paths and for proxy-lock rollback in rt mutex start proxy lock() when called from futex requeue(). In the latter case, the function incorrectly operates on the current task instead of the waiter::task, leading to several problems: the rbtree dequeue occurs without the waiter::task::pi lock being held, the pi blocked on state of the waiter task is not cleared (leaving a dangling pointer), and the rt mutex adjust prio chain() function operates on the wrong top priority waiter task.

This flaw allows a locally authenticated, unprivileged user to hijack a freed kernel pointer to gain full root privileges and escape containers to compromise the host system. The issue is present if the CONFIG FUTEX PI parameter is enabled, which is the default for most general-purpose Linux kernels. Real-world exploitation has been reported with a success rate of approximately 97%, allowing root access in about five seconds.

Recommendations Update the Linux kernel to version 7.1 or later. As a temporary mitigation, enable the RANDOMIZE KSTACK OFFSET kernel protection feature to reduce the reliability of exploitation.