Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-43499— rtmutex: Use waiter::task instead of current in remove_waiter()

Quick assessment

Affected
Linux Linux
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rtmutex中remove_waiter函数使用current而非waiter::task，可能导致红黑树出队未持有锁、pi_blocked_on状态未清除以及优先级调整操作错误。

CVSS 7.8 · High EPSS 0.77% · P53

Possible ATT&CK Techniques 1 AI

T1211 · Exploitation for Stealth

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 8161239a8bcce9ad6b537c04a1fa3b5c68bae693< f3fa3424bceb128d2be4b3745506b22844b87db7 affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< d8cce4773c2b23d819baf5abedc62f7b430e8745 affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 8a1fc8d698ac5e5916e3082a0f74450d71f9611f affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 6d52dfcb2a5db86e346cf51f8fcf2071b8085166 affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3fb7394a837740770f0d6b4b30567e60786a63f2 affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 88614876370aac8ad1050ad785a4c095ba17ac11 affected
8161239a8bcce9ad6b537c04a1fa3b5c68bae693< 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43499

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rtmutex: Use waiter::task instead of current in remove_waiter()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rtmutex中remove_waiter函数使用current而非waiter::task，可能导致红黑树出队未持有锁、pi_blocked_on状态未清除以及优先级调整操作错误。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8161239a8bcce9ad6b537c04a1fa3b5c68bae693 ~ f3fa3424bceb128d2be4b3745506b22844b87db7 -
Linux Linux 2.6.39 -

II. Public POCs for CVE-2026-43499

# POC Description Source Link Shenlong Link
AI-Generated POC Premium
default-local-qwen3.6 · 12754 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-43499

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43499 (8)

Same Patch Batch · Linux · 2026-05-21 · 8 CVEs total

CVE-2026-43501 9.8 CRITICAL ipv6: rpl: reserve mac_len headroom when recompressed SRH grows
CVE-2026-43495 8.8 HIGH net: wwan: t7xx: validate port_count against message length in t7xx_port_enum_msg_handler
CVE-2026-43502 7.8 HIGH net/rds: handle zerocopy send cleanup before the message is queued
CVE-2026-43498 7.8 HIGH accel/ivpu: Disallow re-exporting imported GEM objects
CVE-2026-43494 7.8 HIGH net/rds: reset op_nents when zerocopy page pin fails
CVE-2026-43497 7.3 HIGH fbdev: udlfb: add vm_ops to dlfb_ops_mmap to prevent use-after-free
CVE-2026-43496 net/sched: sch_red: Replace direct dequeue call with peek and qdisc_dequeue_peeked

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43499

No comments yet

Leave a comment