NULL pointer dereference in Linux kernel - CVE-2026-53166

Vulnerability identifier: #VU135630

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-53166

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in remove_waiter() in the futex requeue logic when handling FUTEX_CMP_REQUEUE_PI operations that requeue a non-top waiter which already owns the target PI futex. A local user can trigger a self-deadlock condition to cause a denial of service.

Linux kernel
Anolis OS
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
kernel (Red Hat package)
kernel-rt (Red Hat package)
kernel-debug-devel
kernel-doc
kernel-abi-stablelists
python3-perf
perf
kernel-tools-libs-devel
kernel-tools-libs
kernel-tools
kernel-modules-extra
kernel-modules
kernel-headers
kernel-devel
kernel-debug-modules-extra
kernel-debug-modules
kernel-debug-core
kernel-debug
kernel-cross-headers
kernel-core
kernel
bpftool
kernel-debug-modules-internal
kernel-modules-internal

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel (Red Hat package) - addressed in versions 3.10.0-1160.156.1.el7, 4.18.0-305.198.1.el8_4, 4.18.0-372.201.1.el8_6, 4.18.0-477.152.1.el8_8, 5.14.0-284.181.1.el9_2, 5.14.0-570.128.1.el9_6, 6.12.0-231.16.el10nv
kernel-rt (Red Hat package) - addressed in versions 3.10.0-1160.156.1.rt56.1308.el7, 5.14.0-284.181.1.rt14.466.el9_2
kernel-debug-devel - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-doc - update to 4.18.0-553.144.1.0.1
kernel-abi-stablelists - update to 4.18.0-553.144.1.0.1
python3-perf - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
perf - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-tools-libs-devel - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-tools-libs - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-tools - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-modules-extra - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel-modules - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel-headers - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-devel - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-debug-modules-extra - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel-debug-modules - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel-debug-core - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel-debug - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-cross-headers - update to 4.18.0-553.144.1.0.1
kernel-core - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8
kernel - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
bpftool - addressed in versions 4.18.0-553.144.1.0.1, 5.10.134-19.7.1, 5.10.134-19.8, 6.6.102-6.2, 6.6.102-7
kernel-debug-modules-internal - addressed in versions 5.10.134-19.7.1, 5.10.134-19.8
kernel-modules-internal - addressed in versions 5.10.134-19.7.1, 5.10.134-19.8

• https://git.kernel.org/stable/c/16f8e17184b31382076f84751db5ac51fc02733e
• https://git.kernel.org/stable/c/1f2f3f3eacd6653ab215c5d2ea70811148d433fc
• https://git.kernel.org/stable/c/74e144274af39935b0f410c0ee4d2b91c3730414

• NULL pointer dereference in Linux kernel futex
• NVIDIA for RHEL 10 update for kernel
• Red Hat Enterprise Linux 9 update for kernel-rt
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Red Hat Enterprise Linux 9 update for kernel
• Red Hat Enterprise Linux 9 update for kernel
• Red Hat Enterprise Linux 8 update for kernel
• Anolis OS update for kernel:4.18
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel-rt
• Red Hat Enterprise Linux 7 Extended Lifecycle Support update for kernel
• Anolis OS update for kernel:5.10
• Anolis OS update for kernel:5.10
• Anolis OS update for kernel:6.6
• Anolis OS update for kernel:6.6