CVE-2026-43499— Linux 内核 rtmutex 远程代码执行漏洞
可能的 ATT&CK 技术 1AI
T1211 · Exploitation for Stealth影响版本矩阵 12
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Linux | Linux | 8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 8a1fc8d698ac5e5916e3082a0f74450d71f9611f | affected |
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3fb7394a837740770f0d6b4b30567e60786a63f2 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 88614876370aac8ad1050ad785a4c095ba17ac11 | affected | ||
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 | affected | ||
2.6.39 | affected | ||
< 2.6.39 | unaffected | ||
6.6.140≤ 6.6.* | unaffected | ||
| … +4 条更多 | |||
获取后续新漏洞提醒登录后订阅
一、 漏洞 CVE-2026-43499 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗ 尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
rtmutex: Use waiter::task instead of current in remove_waiter()
来源: 美国国家漏洞数据库 NVD
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
来源: 美国国家漏洞数据库 NVD
CVSS Information
N/A
来源: 美国国家漏洞数据库 NVD
Vulnerability Type
N/A
来源: 美国国家漏洞数据库 NVD
受影响产品
二、漏洞 CVE-2026-43499 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-43499 的情报信息
请登录查看更多情报信息。
补丁 · 5
同批安全公告 · Linux · 2026-05-21 · 共 8 条
| CVE-2026-43502 | Linux net/rds 零拷贝发送清理顺序漏洞 | |
| CVE-2026-43501 | IPv6 RPL SRH压缩增长时mac_len头空间预留漏洞 | |
| CVE-2026-43498 | Linux内核accel/ivpu模块对象重导出漏洞 | |
| CVE-2026-43497 | udlfb 漏洞：添加 vm_ops 防止使用后即释放 | |
| CVE-2026-43496 | Linux 内核 sch_red 远程代码执行漏洞 | |
| CVE-2026-43495 | T7xx WWAN 驱动端口计数验证缺失漏洞 | |
| CVE-2026-43494 | net/rds 零复制页面固定失败时未重置op_nents漏洞 |
IV. Related Vulnerabilities
V. Comments for CVE-2026-43499
暂无评论