CVE-2026-53166: futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock
In the Linux kernel, the following vulnerability has been resolved:
futex/requeue: Prevent NULL pointer dereference in removewaiter() on self-deadlock
When FUTEXCMPREQUEUEPI requeues a non-top waiter that already owns the target PI futex, taskblocksonrtmutex() returns -EDEADLK before setting waiter->task.
The subsequent removewaiter() in rtmutexstartproxylock() dereferences the NULL waiter->task, causing a kernel crash.
Add a self-deadlock check for non-top waiters before calling rtmutexstartproxylock(), analogous to the top-waiter check in futexlockpiatomic().
Other sources
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.36 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.0.13 - Compensating control
Add a self-deadlock check for non-top waiters before calling rt_mutex_start_proxy_lock(); ensure task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task, preventing remove_waiter() from dereferencing a NULL waiter->task.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53166?
The severity of CVE-2026-53166 is rated at risk 44.
How do I fix CVE-2026-53166?
To fix CVE-2026-53166, update the Linux kernel to the latest stable version that contains the patch for this vulnerability.
What type of vulnerability is CVE-2026-53166?
CVE-2026-53166 is classified as a Null Pointer Dereference vulnerability.
What area of the Linux kernel does CVE-2026-53166 affect?
CVE-2026-53166 affects the futex system calls in the Linux kernel.
What issues does CVE-2026-53166 pose for Linux users?
CVE-2026-53166 can lead to application crashes or unexpected behavior due to a NULL pointer dereference.