[SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-43499

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43499

[ Impact ]

remove_waiter() in the rtmutex slow path operated on "current" instead of
the actual waiter task. When called for proxy-lock rollback in
rt_mutex_start_proxy_lock() via futex_requeue(), waiter::task is not
current, so the rbtree dequeue ran without holding the waiter's pi_lock and
left the waiter's pi_blocked_on set. That dangling pointer is primed for a
use-after-free, and rt_mutex_adjust_prio_chain() acts on the wrong top
waiter. It is reachable locally through the futex requeue path.

[ Fix ]

noble/linux-hwe-6.17: clean cherry-pick

[ Test Plan ]

Build tested only (CBD).

[ Where Problems Could Occur ]

The change is in the core priority-inheritance rtmutex slow path
(kernel/locking/rtmutex.c). A mistake here could affect PI correctness or
lock ordering on futex requeue and PREEMPT_RT, but this is a clean pick of
the upstream fix with no adaptation.