UBUNTU-CVE-2026-80777: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Plug private futex exec() race The check for private futexes whether the waiter's mm, which is stored in the futexkey and copied into the pistate, is the same as the owner's mm is not sufficient for exec(). exec() has a gap where the mm check fails to give the correct answer: exec() ... execreleasemm() futexexecrelease() tsk::futex::exitstate = EXITING; cleanuprobustlist(); 1) tsk::futex::exitstate = OK; ... oldmm = tsk::mm; 2) tsk::mm = ->mm; Between #1 and #2 the check for the mm is wrong as that mm is about to be swapped out and eventually freed. Plug this gap by: 1) Setting tsk::futex::exitstate to FUTEXSTATEDEAD in futexexecrelease() 2) Setting tsk::futex::exitstate to FUTEXSTATEOK after the mm has been switched. From a futex point of view the task is dead after it finished the robust list cleanup up to the point where it sets the state to OK again.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Configuration
Set tsk::futex::exit_state to FUTEX_STATE_DEAD in futex_exec_release(), then set it to FUTEX_STATE_OK after the mm has been switched.
Linux kernel futex/pi tsk::futex::exit_state = FUTEX_STATE_DEAD during futex_exec_release(); FUTEX_STATE_OK after the mm has been switched
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What conditions are involved in triggering the race?
The issue involves private priority-inheritance futex handling while a task executes exec(). The vulnerable window occurs after robust-list cleanup, when the task's futex exit state has been reset but before its memory map has been switched.
What does the fix change?
The fix marks the task's futex exit state as FUTEX_STATE_DEAD during futex_exec_release(), then restores FUTEX_STATE_OK only after the memory map switch. This prevents private-futex ownership checks from treating an mm that is being replaced as valid.