Skip to main content

Linux Kernel EUVDEUVD-2026-39254

| CVE-2026-53163 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-25 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-4w7w-2mrj-36vw
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local unprivileged futex invocation (AV:L, PR:L) causes kernel NULL dereference crash; no confidentiality or integrity impact, scope unchanged.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 07, 2026 - 20:31 vuln.today
CVSS changed
Jul 07, 2026 - 18:22 NVD
5.5 (MEDIUM)
Patch available
Jun 25, 2026 - 10:32 EUVD
CVE Published
Jun 25, 2026 - 09:16 nvd
MEDIUM 5.5
CVE Published
Jun 25, 2026 - 09:16 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI:

KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0

task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal.

Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex().

AnalysisAI

Null pointer dereference in the Linux kernel's real-time mutex (rtmutex) subsystem allows a local low-privileged user to crash the kernel via FUTEX_CMP_REQUEUE_PI, causing a denial of service. Affected stable branches span Linux 6.1 through 7.1-rc5; vendor patches are available via kernel.org stable commits. No public exploit has been identified and EPSS is 0.17% (7th percentile), indicating negligible observed exploitation activity.

Technical ContextAI

The vulnerability is located in kernel/locking/rtmutex.c within remove_waiter(). The rtmutex subsystem implements priority-inheritance locking, critical for real-time scheduling fairness. The FUTEX_CMP_REQUEUE_PI syscall allows requeueing futex waiters from a non-PI futex to a PI futex, which invokes rt_mutex_start_proxy_lock(). When task_blocks_on_rt_mutex() detects a potential deadlock, it returns early without arming the waiter struct, leaving waiter->task as NULL. Commit 3bfdc63936dd changed remove_waiter() to use waiter::task instead of the current task pointer, making this uninitialized NULL dereference fatal. A second logic flaw causes rt_mutex_start_proxy_lock() to incorrectly invoke remove_waiter() even upon successfully acquiring the rtmutex. CWE-476 (NULL Pointer Dereference) describes the root cause exactly, confirmed via a KASAN splat reproduced by syzbot. Affected CPE: cpe:2.3:o:linux:linux_kernel across multiple stable series.

RemediationAI

Apply the vendor-released stable kernel patches available from kernel.org. The authoritative fix commits are: 40a25d59e85b3c8709ac2424d44f65610467871e (https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e), 55363fa0a04524d11efeaadee734d2db1756ed27, a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53, 4afda3a1da02129568a3a2f1898aa13e6763bcba, 5799f9bd7fee40370b93ab1ddf001cdc7017c14d, and 6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48. Linux distribution vendors shipping affected 6.1, 6.6, 6.12, 6.18, or 7.0 stable kernels should track their respective upstream stable updates. Where immediate kernel updates are operationally infeasible, deploying seccomp profiles that block or restrict the futex syscall with FUTEX_CMP_REQUEUE_PI (cmd value 12) on sensitive or untrusted workloads prevents exploitation via this path, with the trade-off that applications relying on PI futex requeue semantics (typically real-time or multimedia workloads) may be disrupted.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-39254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy