Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-53163— locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

AI Predicted 7.8 Difficulty: Moderate EPSS 0.12% · P2

Affected Version Matrix 13

VendorProductVersion RangeStatus
LinuxLinuxf3fa3424bceb128d2be4b3745506b22844b87db7< bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1affected
838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd< 4ffacf76a457b7ca8ac05f5df8740b0d8f53574aaffected
d8cce4773c2b23d819baf5abedc62f7b430e8745< 4afda3a1da02129568a3a2f1898aa13e6763bcbaaffected
8a1fc8d698ac5e5916e3082a0f74450d71f9611f< 6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48affected
6d52dfcb2a5db86e346cf51f8fcf2071b8085166< 5799f9bd7fee40370b93ab1ddf001cdc7017c14daffected
3fb7394a837740770f0d6b4b30567e60786a63f2< a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53affected
88614876370aac8ad1050ad785a4c095ba17ac11< 55363fa0a04524d11efeaadee734d2db1756ed27affected
3bfdc63936dd4773109b7b8c280c0f3b5ae7d349< 40a25d59e85b3c8709ac2424d44f65610467871eaffected
… +5 more rows
Get alerts for future matching vulnerabilitiesLog in to subscribe

I. Basic Information for CVE-2026-53163

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex().
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于在remove_waiter()中未正确检查waiter是否已入队，可能导致空指针取消引用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

VendorProductAffected VersionsCPESubscribe
LinuxLinux f3fa3424bceb128d2be4b3745506b22844b87db7 ~ bfbc047ceb42c0e1fac8f3a155d4548a8bbe76b1 -
LinuxLinux 6.1.175 ~ 6.1.177 -

II. Public POCs for CVE-2026-53163

#POC DescriptionSource LinkShenlong Link
AI-Generated POCPremium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53163

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53163 (7)

Same Patch Batch · Linux · 2026-06-25 · 146 CVEs total

CVE-2026-532479.8 CRITICALnet: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
CVE-2026-532159.8 CRITICALnet: mvpp2: refill RX buffers before XDP or skb use
CVE-2026-532169.8 CRITICALnet: mvpp2: limit XDP frame size to the RX buffer
CVE-2026-532469.8 CRITICALsctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
CVE-2026-531519.8 CRITICALrxrpc: Fix the ACK parser to extract the SACK table for parsing
CVE-2026-532219.8 CRITICALip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
CVE-2026-532609.8 CRITICALtcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-531759.8 CRITICALinet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
CVE-2026-531769.8 CRITICALIB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
CVE-2026-532289.8 CRITICALipv6: sit: reload inner IPv6 header after GSO offloads
CVE-2026-531319.4 CRITICALnetfilter: require Ethernet MAC header before using eth_hdr()
CVE-2026-532259.1 CRITICALsctp: fix uninit-value in __sctp_rcv_asconf_lookup()
CVE-2026-532249.1 CRITICALsctp: validate embedded INIT chunk and address list lengths in cookie
CVE-2026-531869.1 CRITICALRDMA/srp: bound SRP_RSP sense copy by the received length
CVE-2026-532408.8 HIGHxfrm: iptfs: fix use-after-free on first_skb in __input_process_payload
CVE-2026-531708.8 HIGHaccel/ethosu: reject DMA commands with uninitialized length
CVE-2026-532488.8 HIGHnet: airoha: Fix use-after-free in metadata dst teardown
CVE-2026-532008.8 HIGHKVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
CVE-2026-531988.8 HIGHksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
CVE-2026-531888.8 HIGHRDMA/core: Validate the passed in fops for ib_get_ucaps()

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53163

No comments yet

Leave a comment