CVE-2026-74658

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

futex: Prevent robust futex exit race some more

A robust futex unlock stores 0 over the whole futex value - wiping

FUTEX_WAITERS - and wakes a single waiter. That wakeup is a one-shot

notification: the protocol relies on its recipient to either acquire the

futex (and eventually unlock while aware of the remaining contention) or

re-arm FUTEX_WAITERS before sleeping again. If the woken waiter is killed

before it can do either, the kernel must jump in and wake the next task

down the line.

This is a known complication of the futex protocol with a previous

partial fix in commit ca16d5bee598 ("futex: Prevent robust futex exit

race"). Unfortunately, that fix is insufficient.

If a third task re-acquired the futex through the uncontended fast

path in the meantime, the notification is lost: robust exit processing

sees that it is owned by another task and does nothing, while the new

owner sees no FUTEX_WAITERS when it unlock

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References