Fedora Account System
Red Hat Associate
Red Hat Customer
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2026052158-CVE-2026-43499-1294@gregkh/T
This issue has been addressed in the following products: NVIDIA for RHEL 10 Via RHSA-2026:37728 https://access.redhat.com/errata/RHSA-2026:37728
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:38492 https://access.redhat.com/errata/RHSA-2026:38492
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:38491 https://access.redhat.com/errata/RHSA-2026:38491
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39082 https://access.redhat.com/errata/RHSA-2026:39082
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:39083 https://access.redhat.com/errata/RHSA-2026:39083
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:39983 https://access.redhat.com/errata/RHSA-2026:39983
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:39984 https://access.redhat.com/errata/RHSA-2026:39984
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On Via RHSA-2026:40068 https://access.redhat.com/errata/RHSA-2026:40068
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:40082 https://access.redhat.com/errata/RHSA-2026:40082
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:40425 https://access.redhat.com/errata/RHSA-2026:40425
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:40760 https://access.redhat.com/errata/RHSA-2026:40760
This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:41062 https://access.redhat.com/errata/RHSA-2026:41062
This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:41063 https://access.redhat.com/errata/RHSA-2026:41063
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:41234 https://access.redhat.com/errata/RHSA-2026:41234
This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:41235 https://access.redhat.com/errata/RHSA-2026:41235