Vulnerability Details CVE-2026-53166
In the Linux kernel, the following vulnerability has been resolved:
futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the
target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting
waiter->task.
The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences
the NULL waiter->task, causing a kernel crash.
Add a self-deadlock check for non-top waiters before calling
rt_mutex_start_proxy_lock(), analogous to the top-waiter check in
futex_lock_pi_atomic().
Exploit prediction scoring system (EPSS) score
EPSS Score 0.002
EPSS Ranking 7.0%
CVSS Severity
CVSS v3 Score 5.5
References
Products affected by CVE-2026-53166
-
cpe:2.3:o:linux:linux_kernel:6.1.175
-
cpe:2.3:o:linux:linux_kernel:6.12.86
-
cpe:2.3:o:linux:linux_kernel:6.12.87
-
cpe:2.3:o:linux:linux_kernel:6.12.88
-
cpe:2.3:o:linux:linux_kernel:6.12.91
-
cpe:2.3:o:linux:linux_kernel:6.18.28
-
cpe:2.3:o:linux:linux_kernel:6.18.29
-
cpe:2.3:o:linux:linux_kernel:6.18.30
-
cpe:2.3:o:linux:linux_kernel:6.18.33
-
cpe:2.3:o:linux:linux_kernel:6.6.140
-
cpe:2.3:o:linux:linux_kernel:6.6.141
-
cpe:2.3:o:linux:linux_kernel:7.1