Race condition in Linux kernel - CVE-2026-74658

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper synchronization in the robust futex handling in kernel/futex/core.c when processing robust futex exit conditions. A local user can trigger a race condition involving futex waiters to cause a denial of service.

The issue can leave waiting tasks blocked indefinitely due to a lost wakeup.

Affected software

How to mitigate CVE-2026-74658

External References

• https://git.kernel.org/stable/c/33bfa85458105d6169ebdb697f692b8bb8025bae
• https://git.kernel.org/stable/c/6d4514ca9cdf61fec4ec634cf50386f6f7e69748
• https://git.kernel.org/stable/c/7b8c53263f8878bdd12c87e147ac6feca5c05211
• https://git.kernel.org/stable/c/7cf710e70f9bb8ea75f759ebed09871801315992
• https://git.kernel.org/stable/c/83b0f71d5a313a765754acab51d2ecc5de76e0b9
• https://git.kernel.org/stable/c/925628656b73b70930972ccde421de4f758d8650
• https://git.kernel.org/stable/c/a1c2b7b86a946b6b172bce44d74553da2323a36c
• https://git.kernel.org/stable/c/aa5c571901c6b22b58373693a4bf889ecab11ff5

Related Security Bulletins

• Race condition in Linux kernel futex
• Debian update for linux