{"schema":"threatline.record/2","record":{"id":"CVE-2026-43499","aliases":[],"summary":"rtmutex: Use waiter::task instead of current in remove_waiter()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"f3fa3424bceb128d2be4b3745506b22844b87db7","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"d8cce4773c2b23d819baf5abedc62f7b430e8745","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"8a1fc8d698ac5e5916e3082a0f74450d71f9611f","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"6d52dfcb2a5db86e346cf51f8fcf2071b8085166","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"3fb7394a837740770f0d6b4b30567e60786a63f2","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"88614876370aac8ad1050ad785a4c095ba17ac11","status":"affected","versionType":"git"},{"version":"8161239a8bcce9ad6b537c04a1fa3b5c68bae693","lessThan":"3bfdc63936dd4773109b7b8c280c0f3b5ae7d349","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","product":"Linux","vendor":"Linux","versions":[{"version":"2.6.39","status":"affected"},{"version":"0","lessThan":"2.6.39","status":"unaffected","versionType":"semver"},{"version":"5.10.261","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.212","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.140","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.86","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.27","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.4","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"8a1fc8d698ac5e5916e3082a0f74450d71f9611f","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"6d52dfcb2a5db86e346cf51f8fcf2071b8085166","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"3fb7394a837740770f0d6b4b30567e60786a63f2","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"88614876370aac8ad1050ad785a4c095ba17ac11","basis":"first unaffected version stated in the CVE record"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","source_modified_at":"2026-10-15T01:19:29.734Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"Linux","ecosystem":null},"version":"3bfdc63936dd4773109b7b8c280c0f3b5ae7d349","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00789,"percentile":0.55779,"score_date":"2026-10-23"},"published_at":"2026-05-21T12:17:49.281Z","modified_at":"2026-10-15T01:19:29.734Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-43499","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-15T01:19:29.734Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-43499","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/d8cce4773c2b23d819baf5abedc62f7b430e8745"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/8a1fc8d698ac5e5916e3082a0f74450d71f9611f"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/6d52dfcb2a5db86e346cf51f8fcf2071b8085166"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3fb7394a837740770f0d6b4b30567e60786a63f2"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/88614876370aac8ad1050ad785a4c095ba17ac11"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"},{"source":"CVE List","url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-08-22T03:55:28.271423Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-15T01:19:29.734Z","content_hash":"5d1ad12fbfa36312c3926bb93bd78c6d1838b43141a84d58d6bae360ba9780d5"}}