Linux Kernel CVE-2026-31555

The Linux futex (fast user-space mutex) subsystem implements Priority Inheritance semantics via futex_lock_pi() in kernel/futex/core.c. When a PI futex owner is observed to be in the EXITING state, futex_lock_pi_atomic() returns -EBUSY and writes a refcounted task_struct pointer into the caller's local 'exiting' variable via attach_to_pi_owner(). The reference is consumed and dropped by wait_for_owner_exiting() via put_task_struct(), but critically the pointer variable is never reset to NULL. If the outer retry loop re-enters futex_lock_pi_atomic() and that call returns -EAGAIN (because a concurrent cmpxchg modified the futex's user-space value, e.g., toggling the WAITERS bit), the stale non-NULL exiting pointer is passed back into wait_for_owner_exiting() with the wrong error code, violating the function's internal invariant that the pointer is NULL for any error other than -EBUSY, and triggering WARN_ON_ONCE(exiting). The root cause class is a stale/dangling pointer within a concurrent race window - analogous to CWE-672 (Operation on Resource after Expiration or Release) - though no CWE is formally assigned. CPE cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* identifies all affected kernel versions beginning with the commit that introduced the flawed retry path (3ef240eaff36b8119ac9e2ea17cbf41179c930ba) up to the respective fix commits per stable branch.