SB20261029136 - Operation on a Resource after Expiration or Release in Linux kernel futex

Description

This security bulletin contains information about 1 vulnerability.

1) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-99169)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to interfere with futex wakeups and potentially cause a denial of service in affected processes.

The vulnerability exists due to improper resource lifetime tracking in the Linux kernel futex subsystem when matching FUT_OFF_MMSHARED waiters using a memory descriptor address that can be reused after the descriptor is freed. A local user can requeue a FUT_OFF_INODE waiter onto a FUT_OFF_MMSHARED futex and exploit subsequent memory descriptor address reuse to consume wakeups intended for a different process, potentially leaving its threads blocked.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2855ddc6844f527e375e78afb55ec2a5182f23b3
• https://git.kernel.org/stable/c/3267512ad1c2cc0c7768c5b014dc2cceb398a801
• https://git.kernel.org/stable/c/c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81