Answer in brief
CVE-2026-80778 records a Unknown severity vulnerability in futex/pi: Reject cross-mm private futex owners. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=80367ad01d93ac781b0e1df246edaf006928002f <2b92e5562653b5293529f63b0300837d9dcedbd7 || >=80367ad01d93ac781b0e1df246edaf006928002f <f7fb3e07752688842cbe0b85cf0d98c2fbf76b68 || >=80367ad01d93ac781b0e1df246edaf006928002f <43b148d796aa338858792d0167cebdc12b8cb4b9 || >=80367ad01d93ac781b0e1df246edaf006928002f <59b3732f95dda1fbd2234514d35f4fb6b5bb6d85 | 2b92e5562653b5293529f63b0300837d9dcedbd7, f7fb3e07752688842cbe0b85cf0d98c2fbf76b68, 43b148d796aa338858792d0167cebdc12b8cb4b9, 59b3732f95dda1fbd2234514d35f4fb6b5bb6d85 |
| Linux/Linuxgeneric | 6.16 | Not reported |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the waiter's mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different address space and copies the private key into the owner's PI state. When that owner exits, exit_pi_state_list() uses the saved key to find the hash bucket and acquires a reference to the waiter's private hash. If the last user of the waiter's mm exits concurrently, futex_hash_free() frees the hash while the owner still uses its bucket and reference. Prevent this by validating in attach_to_pi_owner() that, for private futexes, the owner mm and waiter mm are the same. Perform the check with the owner's pi_lock held and after validating owner::futex::state to serialize against a concurrent PI-state exit cleanup. [ tglx: Amended comment ]
Quoted source text, attributed separately from HOL analysis.