Operation on a Resource after Expiration or Release in Linux kernel - CVE-2026-99169

Vulnerability details

The vulnerability allows a local user to interfere with futex wakeups and potentially cause a denial of service in affected processes.

The vulnerability exists due to improper resource lifetime tracking in the Linux kernel futex subsystem when matching FUT_OFF_MMSHARED waiters using a memory descriptor address that can be reused after the descriptor is freed. A local user can requeue a FUT_OFF_INODE waiter onto a FUT_OFF_MMSHARED futex and exploit subsequent memory descriptor address reuse to consume wakeups intended for a different process, potentially leaving its threads blocked.

Affected software

How to mitigate CVE-2026-99169

External References

• https://git.kernel.org/stable/c/2855ddc6844f527e375e78afb55ec2a5182f23b3
• https://git.kernel.org/stable/c/3267512ad1c2cc0c7768c5b014dc2cceb398a801
• https://git.kernel.org/stable/c/c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81

Related Security Bulletins

• Operation on a Resource after Expiration or Release in Linux kernel futex
• Debian update for linux