Linux Kernel CVE-2026-53166

The Linux kernel futex subsystem (cpe:2.3:o:linux:linux_kernel) provides fast userspace synchronization primitives via the futex(2) syscall. FUTEX_CMP_REQUEUE_PI is used to atomically requeue waiters from a plain futex onto a PI (Priority Inheritance) futex, which is critical for real-time scheduling (POSIX pthread_cond with PI mutexes). During requeue, futex_requeue() calls rt_mutex_start_proxy_lock() to begin proxy lock acquisition on behalf of each waiter. For a non-top waiter that already holds the target PI mutex, task_blocks_on_rt_mutex() detects the self-deadlock and returns -EDEADLK - but crucially does so without ever setting waiter->task. The error-handling path then calls remove_waiter(), which unconditionally dereferences waiter->task (NULL), triggering a kernel NULL pointer dereference (CWE-476). The top-waiter code path had an analogous guard in futex_lock_pi_atomic() but the non-top-waiter path lacked one.