https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 10:46:55 +0000 https://vulnerability.circl.lu/vuln/cve-2026-80778 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>futex/pi: Reject cross-mm private futex owners</p> <p>A private futex key borrows the waiter&#39;s mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different address space and copies the private key into the owner&#39;s PI state.</p> <p>When that owner exits, exit_pi_state_list() uses the saved key to find the hash bucket and acquires a reference to the waiter&#39;s private hash. If the last user of the waiter&#39;s mm exits concurrently, futex_hash_free() frees the hash while the owner still uses its bucket and reference.</p> <p>Prevent this by validating in attach_to_pi_owner() that, for private futexes, the owner mm and waiter mm are the same. Perform the check with the owner&#39;s pi_lock held and after validating owner::futex::state to serialize against a concurrent PI-state exit cleanup.</p> <p>[ tglx: Amended comment ]</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>futex/pi: Reject cross-mm private futex owners</p> <p>A private futex key borrows the waiter&#39;s mm without taking an mm_users reference. Nevertheless, attach_to_pi_owner() currently accepts an owner from a different address space and copies the private key into the owner&#39;s PI state.</p> <p>When that owner exits, exit_pi_state_list() uses the saved key to find the hash bucket and acquires a reference to the waiter&#39;s private hash. If the last user of the waiter&#39;s mm exits concurrently, futex_hash_free() frees the hash while the owner still uses its bucket and reference.</p> <p>Prevent this by validating in attach_to_pi_owner() that, for private futexes, the owner mm and waiter mm are the same. Perform the check with the owner&#39;s pi_lock held and after validating owner::futex::state to serialize against a concurrent PI-state exit cleanup.</p> <p>[ tglx: Amended comment ]</p> https://vulnerability.circl.lu/vuln/cve-2026-80778