CVE-2026-53166

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference occurs in the remove waiter() function during a self-deadlock scenario. When FUTEX CMP REQUEUE PI requeues a non-top waiter that already owns the target PI futex, the task blocks on rt mutex() function returns -EDEADLK before the waiter->task variable is set. Subsequently, remove waiter() in rt mutex start proxy lock() dereferences the NULL waiter->task, leading to a kernel crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.