Bug 2492805 (CVE-2026-53166) - CVE-2026-53166 kernel: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
Summary: CVE-2026-53166 kernel: futex/requeue: Prevent NULL pointer dereference in rem...
Keywords:
Status: NEW
Alias: CVE-2026-53166
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-06-25 10:06 UTC by OSIDB Bzimport
Modified: 2026-07-17 13:02 UTC (History)
3 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:37728 0 None None None 2026-07-10 12:24:28 UTC
Red Hat Product Errata RHSA-2026:38491 0 None None None 2026-07-13 12:16:13 UTC
Red Hat Product Errata RHSA-2026:38492 0 None None None 2026-07-13 07:59:23 UTC
Red Hat Product Errata RHSA-2026:39082 0 None None None 2026-07-14 05:28:33 UTC
Red Hat Product Errata RHSA-2026:39083 0 None None None 2026-07-14 05:43:22 UTC
Red Hat Product Errata RHSA-2026:39983 0 None None None 2026-07-15 13:41:29 UTC
Red Hat Product Errata RHSA-2026:39984 0 None None None 2026-07-15 13:43:00 UTC
Red Hat Product Errata RHSA-2026:40068 0 None None None 2026-07-15 15:54:32 UTC
Red Hat Product Errata RHSA-2026:40082 0 None None None 2026-07-15 16:03:21 UTC
Red Hat Product Errata RHSA-2026:40425 0 None None None 2026-07-15 23:21:11 UTC
Red Hat Product Errata RHSA-2026:40760 0 None None None 2026-07-16 07:16:22 UTC
Red Hat Product Errata RHSA-2026:41062 0 None None None 2026-07-16 21:26:18 UTC
Red Hat Product Errata RHSA-2026:41063 0 None None None 2026-07-16 21:29:09 UTC
Red Hat Product Errata RHSA-2026:41234 0 None None None 2026-07-17 12:49:25 UTC
Red Hat Product Errata RHSA-2026:41235 0 None None None 2026-07-17 13:02:24 UTC

Description OSIDB Bzimport 2026-06-25 10:06:42 UTC 
In the Linux kernel, the following vulnerability has been resolved:

futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock

When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.

The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.

Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().
Comment 1 TEJ RATHI 2026-06-26 07:10:56 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026062551-CVE-2026-53166-2861@gregkh/T
Comment 5 errata-xmlrpc 2026-07-10 12:24:27 UTC 
This issue has been addressed in the following products:

  NVIDIA for RHEL 10

Via RHSA-2026:37728 https://access.redhat.com/errata/RHSA-2026:37728
Comment 6 errata-xmlrpc 2026-07-13 07:59:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:38492 https://access.redhat.com/errata/RHSA-2026:38492
Comment 7 errata-xmlrpc 2026-07-13 12:16:12 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:38491 https://access.redhat.com/errata/RHSA-2026:38491
Comment 8 errata-xmlrpc 2026-07-14 05:28:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39082 https://access.redhat.com/errata/RHSA-2026:39082
Comment 9 errata-xmlrpc 2026-07-14 05:43:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:39083 https://access.redhat.com/errata/RHSA-2026:39083
Comment 11 errata-xmlrpc 2026-07-15 13:41:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:39983 https://access.redhat.com/errata/RHSA-2026:39983
Comment 12 errata-xmlrpc 2026-07-15 13:42:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:39984 https://access.redhat.com/errata/RHSA-2026:39984
Comment 13 errata-xmlrpc 2026-07-15 15:54:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:40068 https://access.redhat.com/errata/RHSA-2026:40068
Comment 14 errata-xmlrpc 2026-07-15 16:03:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:40082 https://access.redhat.com/errata/RHSA-2026:40082
Comment 15 errata-xmlrpc 2026-07-15 23:21:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:40425 https://access.redhat.com/errata/RHSA-2026:40425
Comment 16 errata-xmlrpc 2026-07-16 07:16:20 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:40760 https://access.redhat.com/errata/RHSA-2026:40760
Comment 17 errata-xmlrpc 2026-07-16 21:26:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:41062 https://access.redhat.com/errata/RHSA-2026:41062
Comment 18 errata-xmlrpc 2026-07-16 21:29:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:41063 https://access.redhat.com/errata/RHSA-2026:41063
Comment 19 errata-xmlrpc 2026-07-17 12:49:24 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:41234 https://access.redhat.com/errata/RHSA-2026:41234
Comment 20 errata-xmlrpc 2026-07-17 13:02:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:41235 https://access.redhat.com/errata/RHSA-2026:41235
Note You need to log in before you can comment on or make changes to this bug.