222 lines
14 KiB
JSON
222 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-90003",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-09-11T19:38:34.780Z",
|
|
"datePublished": "2026-09-16T10:33:13.420Z",
|
|
"dateUpdated": "2026-10-19T08:56:17.256Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-19T08:56:17.256Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Prevent rcuwait use-after-free during requeue PI\n\nOn PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report\n(slab-out-of-bounds) in futex_requeue_pi_complete() invocation of\nrcuwait_wake_up().\n\nThe futex_q used by futex_wait_requeue_pi() is allocated on the waiter's\nstack. An early wakeup can race with a PI requeue as follows:\n\n waiter requeue task\n ------ ------------\nfutex_wait_requeue_pi()\n futex_do_wait()\n schedule()\n futex_requeue\n futex_proxy_trylock_atomic()\n futex_requeue_pi_prepare()\n Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS\n* timeout/ signal wakes waiter *\n futex_requeue_pi_wakeup_sync()\n Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT\n requeue_pi_wake_futex\n futex_requeue_pi_complete()\n cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED\n rcuwait_wait_event()\n if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT)\n break /* no schedule() */\n\n /* q.pi_state->owner == current */\n futex_private_hash_put()\n /* return from syscall */\n rcuwait_wake_up(&q->requeue_wait)\n /* q is gone */\n\nfutex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before\ncalling rcuwait_wake_up(). The waiter observes this state in\nrcuwait_wait_event() before invoking schedule() in rcuwait_wait_event().\nHere, the waiter is free leave the syscall before requeue task can\ncomplete the wake.\n\nTo address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED\ncase.\nThis state is only published by requeue_pi_wake_futex(), which saves\nq->task before futex_requeue_pi_complete() and wakes the waiter via\nwake_up_state().\n\nThis wake is intended to wake the waiter from its futex_do_wait() sleep.\nIf the waiter is still sleeping there, it can not get into the\nQ_REQUEUE_PI_WAIT state (and require this removed wake).\nShould the waiter be woken up from futex_do_wait() by other means (as in\nthis example) and sleep in futex_requeue_pi_wakeup_sync() then the\nwake_up_state() from requeue_pi_wake_futex() will wake it, too.\nShould the waiter task terminate before wake_up_state() had a chance to\nwake the task then the task pointer does not become invalid because the\nfutex_hash_bucket::lock is held and the task pointer is RCU protected.\n\n[bigeasy: Updated comment and commit message]"
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - The bug is reached only through the local futex(2) syscalls FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI into kernel/futex/requeue.c; there is no network, Bluetooth, or physical-device path.\nAC:L - The attacker controls both sides of the race: a waiter thread using FUTEX_WAIT_REQUEUE_PI with an attacker-chosen timeout or signal, and a concurrent FUTEX_CMP_REQUEUE_PI from another thread, and can retry with CPU pinning until the waiter returns before rcuwait_wake_up() on PREEMPT_RT.\nPR:L - Any unprivileged local user can invoke futex() with FUTEX_WAIT_REQUEUE_PI and FUTEX_CMP_REQUEUE_PI; do_futex() and futex_requeue() perform no capability or credential checks, CONFIG_FUTEX_PI is default-y, and the path is reachable from containers without elevated privileges.\nUI:N - The attacker's own threads perform the wait, timeout or signal, and PI requeue; no victim action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free corrupts kernel memory (the waiter's stack-allocated futex_q and a type-confused task_struct) within the same kernel security authority; this is a standard local privilege-escalation issue, not a VM, IOMMU, or hypervisor escape.\nC:H - This is a use-after-free of the waiter's stack-allocated futex_q.requeue_wait; rcuwait_wake_up() reads a stale, attacker-refilled task_struct pointer and dereferences it in try_to_wake_up(), enabling arbitrary kernel-memory disclosure.\nI:H - The stale futex_q lives on the attacker's own kernel stack, which a following syscall can refill with controlled bytes, so rcuwait_wake_up() passes an attacker-chosen pointer into try_to_wake_up(), which writes task state and makes indirect scheduler calls, enabling privilege escalation.\nA:H - In the unexploited case, rcuwait_wake_up() dereferences a wild pointer from reused stack memory and causes a kernel oops or panic; any use-after-free of this kind is a High availability impact."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/futex/requeue.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "220ee9e04ca3b7f014c000264aa6c884f036c86e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "81aadbd09bf1dcd3238212f336ba699503557ae8",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "244f301759fd34b1dd0b4192ce44f8ef224e027d",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "7d1559126d86be6e4f6a85663dfbfe85caa47e37",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "e4a4ccfa470f910b747b3ee8d18670ed8ac8a236",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "07d91ef510fb16a2e0ca7453222105835b7ba3b8",
|
|
"lessThan": "a3b8d46fe401cba3a5c46dea610e6eb3dc15370e",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"kernel/futex/requeue.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.188",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.157",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.110",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.51",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.5",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.1.188"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.6.157"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.12.110"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "6.18.51"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "7.2.5"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.15",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/220ee9e04ca3b7f014c000264aa6c884f036c86e"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/81aadbd09bf1dcd3238212f336ba699503557ae8"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/244f301759fd34b1dd0b4192ce44f8ef224e027d"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/7d1559126d86be6e4f6a85663dfbfe85caa47e37"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/e4a4ccfa470f910b747b3ee8d18670ed8ac8a236"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a3b8d46fe401cba3a5c46dea610e6eb3dc15370e"
|
|
}
|
|
],
|
|
"title": "futex: Prevent rcuwait use-after-free during requeue PI",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
}
|
|
}
|
|
} |