CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter()
In removewaiter of rtmutex.c, there is a possible use-after-free due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
— Launchpad
rtmutex: Use waiter::task instead of current in removewaiter()
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-2Fixed in 7.1.10-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.180-1~deb11u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.261 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.212 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.175 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.140 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.86 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.27 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.4 - Upgrade
Upgrade
android/:linux_kernel:to a version that resolves this vulnerability.Fixed in :2026-11-05 - Compensating control
Apply the rtmutex code fix in remove_waiter(): use waiter::task instead of current in all related operations, including the rbtree dequeue and clearing the waiter task's pi_blocked_on state.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43499?
CVE-2026-43499 has a risk score of 52, indicating a medium severity vulnerability.
How do I fix CVE-2026-43499?
To mitigate CVE-2026-43499, update the Linux kernel to the latest patched version provided by your distribution.
What systems are affected by CVE-2026-43499?
CVE-2026-43499 affects specific versions of the Linux kernel.
What does CVE-2026-43499 impact?
CVE-2026-43499 impacts the functionality of rtmutex by altering the mechanism used in remove_waiter(), potentially affecting proxy-lock rollback operations.
Is there a workaround for CVE-2026-43499?
No specific workaround is recommended for CVE-2026-43499; applying updates is the best course of action.