CVE-2026-53163

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

syzbot triggered the following splat in remove_waiter() via

FUTEX_CMP_REQUEUE_PI:

KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f]

class_raw_spinlock_constructor

remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561

rt_mutex_start_proxy_lock+0x103/0x120

futex_requeue+0x10e4/0x20d0

__x64_sys_futex+0x34f/0x4d0

task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection,

leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead

of current in remove_waiter()") made this fatal.

Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter()

upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock

return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock()

(where 'ret' was only ever 0 or < 0) into the wrapp

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References