Answer in brief
CVE-2026-90003 records a High severity (CVSS 7.8) vulnerability in futex: Prevent rcuwait use-after-free during requeue PI. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <220ee9e04ca3b7f014c000264aa6c884f036c86e || >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <81aadbd09bf1dcd3238212f336ba699503557ae8 || >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <244f301759fd34b1dd0b4192ce44f8ef224e027d || >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <7d1559126d86be6e4f6a85663dfbfe85caa47e37 || >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <e4a4ccfa470f910b747b3ee8d18670ed8ac8a236 || >=07d91ef510fb16a2e0ca7453222105835b7ba3b8 <a3b8d46fe401cba3a5c46dea610e6eb3dc15370e | 220ee9e04ca3b7f014c000264aa6c884f036c86e, 81aadbd09bf1dcd3238212f336ba699503557ae8, 244f301759fd34b1dd0b4192ce44f8ef224e027d, 7d1559126d86be6e4f6a85663dfbfe85caa47e37, e4a4ccfa470f910b747b3ee8d18670ed8ac8a236, a3b8d46fe401cba3a5c46dea610e6eb3dc15370e |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Sep 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 16, 2026
In the Linux kernel, the following vulnerability has been resolved: futex: Prevent rcuwait use-after-free during requeue PI On PREEMPT_RT, FUTEX_CMP_REQUEUE_PI can trigger a KASAN report (slab-out-of-bounds) in futex_requeue_pi_complete() invocation of rcuwait_wake_up(). The futex_q used by futex_wait_requeue_pi() is allocated on the waiter's stack. An early wakeup can race with a PI requeue as follows: waiter requeue task ------ ------------ futex_wait_requeue_pi() futex_do_wait() schedule() futex_requeue futex_proxy_trylock_atomic() futex_requeue_pi_prepare() Q_REQUEUE_PI_NONE -> Q_REQUEUE_PI_IN_PROGRESS * timeout/ signal wakes waiter * futex_requeue_pi_wakeup_sync() Q_REQUEUE_PI_IN_PROGRESS -> Q_REQUEUE_PI_WAIT requeue_pi_wake_futex futex_requeue_pi_complete() cmpxchg Q_REQUEUE_PI_WAIT -> Q_REQUEUE_PI_LOCKED rcuwait_wait_event() if (atomic_read(&q->requeue_state) != Q_REQUEUE_PI_WAIT) break /* no schedule() */ /* q.pi_state->owner == current */ futex_private_hash_put() /* return from syscall */ rcuwait_wake_up(&q->requeue_wait) /* q is gone */ futex_requeue_pi_complete() publishes Q_REQUEUE_PI_LOCKED before calling rcuwait_wake_up(). The waiter observes this state in rcuwait_wait_event() before invoking schedule() in rcuwait_wait_event(). Here, the waiter is free leave the syscall before requeue task can complete the wake. To address this race skip rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case. This state is only published by requeue_pi_wake_futex(), which saves q->task before futex_requeue_pi_complete() and wakes the waiter via wake_up_state(). This wake is intended to wake the waiter from its futex_do_wait() sleep. If the waiter is still sleeping there, it can not get into the Q_REQUEUE_PI_WAIT state (and require this removed wake). Should the waiter be woken up from futex_do_wait() by other means (as in this example) and sleep in futex_requeue_pi_wakeup_sync() then the wake_up_state() from requeue_pi_wake_futex() will wake it, too. Should the waiter task terminate before wake_up_state() had a chance to wake the task then the task pointer does not become invalid because the futex_hash_bucket::lock is held and the task pointer is RCU protected. [bigeasy: Updated comment and commit message]
Quoted source text, attributed separately from HOL analysis.