ACK/Cmnt: [SRU][N:hwe-6.17/N:hwe-6.17][PATCH 0/2] CVE-2026-43499

[Alessio Faina]

On Wed, Jul 22, 2026 at 08:02:21PM +0300, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-43499
> 
> [ Impact ]
> 
> remove_waiter() in the rtmutex slow path operated on "current" instead of
> the actual waiter task. When called for proxy-lock rollback in
> rt_mutex_start_proxy_lock() via futex_requeue(), waiter::task is not
> current, so the rbtree dequeue ran without holding the waiter's pi_lock and
> left the waiter's pi_blocked_on set. That dangling pointer is primed for a
> use-after-free, and rt_mutex_adjust_prio_chain() acts on the wrong top
> waiter. It is reachable locally through the futex requeue path.
> 
> [ Fix ]
> 
> noble/linux-hwe-6.17: clean cherry-pick
> 
> [ Test Plan ]
> 
> Build tested only (CBD).
> 
> [ Where Problems Could Occur ]
> 
> The change is in the core priority-inheritance rtmutex slow path
> (kernel/locking/rtmutex.c). A mistake here could affect PI correctness or
> lock ordering on futex requeue and PREEMPT_RT, but this is a clean pick of
> the upstream fix with no adaptation.
> 
> -- 
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team

N:hwe-6.17 is mentioned twice in the subject.

Acked-by: Alessio Faina <alessio.faina at canonical.com>