[SRU][N:linux-hwe-6.17][PATCH 0/2] CVE-2026-43499, CVE-2026-53163

[Fedor Veselovskii]

From: fviolence <asetium at gmail.com>

https://ubuntu.com/security/CVE-2026-43499
https://ubuntu.com/security/CVE-2026-53163

[ Impact ]

Noble linux-hwe-6.17 is vulnerable to CVE-2026-43499. During futex PI proxy
lock rollback, remove_waiter() can operate on current instead of waiter->task.
This can dequeue without holding the correct pi_lock, leave a dangling
pi_blocked_on pointer, and run priority-chain adjustment for the wrong task,
creating a use-after-free condition.

The first fix exposes a separate error path in which waiter->task can still be
NULL because the waiter was never enqueued. That regression is tracked as
CVE-2026-53163, so the second patch is mandatory and must be applied together
with the first.

[ Fix ]

Patch 1 changes remove_waiter() to use waiter->task consistently.

Patch 2 guards the never-enqueued NULL waiter case and changes
rt_mutex_start_proxy_lock() to invoke remove_waiter() only for negative return
values. A positive return means the proxy task acquired the lock immediately
and no waiter cleanup is required.

[ Test Plan ]

- Built Ubuntu linux-hwe-6.17 amd64 packages successfully.
- Booted the resulting generic kernel and exercised normal server workloads.
- Ran the complete futex selftest suite as root successfully.
- Repeated the complete root futex suite 20 times; every run completed with
  status 0. One CPU-count-dependent test was skipped on the four-CPU test
  system; there were no failures or errors.
- Ran the complete epoll selftest suite: 64 passed, 0 failed, 0 skipped.
- Ran stress-ng with two epoll workers for 10 minutes with verification:
  0 failures.
- Kernel taint remained 0. No kernel oops, use-after-free report, NULL pointer
  dereference, call trace, lockup, hung task, or futex/rtmutex warning was
  observed.
- No failed systemd services were present and normal container workloads
  remained operational.

[ Where problems could occur ]

The changes affect rtmutex PI waiter removal and FUTEX_REQUEUE_PI rollback.
A regression could appear as incorrect priority inheritance, a waiter left in
an rtmutex tree, a stale pi_blocked_on pointer, deadlock, task hang, or a NULL
pointer dereference during proxy-lock error handling.

[ Other Info ]

CVE-2026-53163 is a mandatory follow-up to the CVE-2026-43499 fix. The two
patches must be reviewed and applied as one ordered series.

Davidlohr Bueso (1):
  locking/rtmutex: Skip remove_waiter() when waiter is not enqueued

Keenan Dong (1):
  rtmutex: Use waiter::task instead of current in remove_waiter()

 kernel/locking/rtmutex.c     | 16 +++++++++++-----
 kernel/locking/rtmutex_api.c |  2 +-
 2 files changed, 12 insertions(+), 6 deletions(-)

-- 
2.43.0