PT-2026-85618 · Linux · Linux
CVE-2026-80777
·
Published
2026-09-04
·
Updated
2026-09-04
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
futex/pi: Plug private futex exec() race
The check for private futexes whether the waiter's mm, which is stored in
the futex key and copied into the pi state, is the same as the owner's mm
is not sufficient for exec(). exec() has a gap where the mm check fails to
give the correct answer:
exec()
...
exec release mm()
futex exec release()
tsk::futex::exit state = EXITING;
cleanup robust list();
- tsk::futex::exit state = OK; ... old mm = tsk::mm;
- tsk::mm = ->mm;
Between #1 and #2 the check for the mm is wrong as that mm is about to be
swapped out and eventually freed.
Plug this gap by:
-
Setting tsk::futex::exit state to FUTEX STATE DEAD in futex exec release()
-
Setting tsk::futex::exit state to FUTEX STATE OK after the mm has been switched.
From a futex point of view the task is dead after it finished the robust
list cleanup up to the point where it sets the state to OK again.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux