CVE-2026-31555: Linux Kernel Race Condition Vulnerability

CVE-2026-31555 Overview

CVE-2026-31555 is a kernel vulnerability in the Linux kernel's futex (fast userspace mutex) subsystem. The flaw resides in the futex_lock_pi() retry path, where a stale exiting task pointer is not cleared after wait_for_owner_exiting() consumes its reference. On a retry following a different error from futex_lock_pi_atomic(), the bogus pointer is passed back to wait_for_owner_exiting(), triggering a WARN_ON_ONCE() at kernel/futex/core.c:825. The issue was discovered through fuzzing and stress testing of futexes.

Critical Impact
A local, low-privileged user can trigger kernel state corruption in the PI-futex retry path, resulting in a kernel warning and potential denial of service on the affected host.

Affected Products

Linux Kernel (multiple stable branches per the upstream fix commits)
Linux Kernel 5.5 release
Linux Kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-24 - CVE-2026-31555 published to NVD
2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-31555

Vulnerability Analysis

The vulnerability lives in the priority-inheritance (PI) futex acquisition path. When futex_lock_pi_atomic() detects that the current owner is exiting, it returns -EBUSY and stores a refcounted task_struct pointer in the caller's local exiting variable. The caller then invokes wait_for_owner_exiting(), which drops that reference via put_task_struct().

The bug is that the local pointer is never reset to NULL after the reference is consumed. If the path retries and futex_lock_pi_atomic() returns a different error such as -EAGAIN, the still-populated stale pointer is passed back into wait_for_owner_exiting(). The function's invariant assertion WARN_ON_ONCE(exiting) fires because a non-NULL pointer is supplied for an error code that should carry no exiting task.

Root Cause

The root cause is incomplete state cleanup across loop iterations in futex_lock_pi(). The control flow assumes the exiting slot is consumed only once, but the retry branch does not re-initialize the variable. This is a kernel state management defect analogous to a stale reference, where the lifetime of an out-parameter is not aligned with the surrounding loop's reuse pattern. The companion requeue_pi path already handled this correctly, and the fix aligns futex_lock_pi() with that pattern.

Attack Vector

Exploitation requires local access and the ability to issue futex syscalls, which is available to any unprivileged user. A concurrent workload that races a PI-futex owner's exit with new lock acquisition attempts, combined with a cmpxchg value change on uaddr between iterations, drives the path that returns -EAGAIN on retry. The original proof-of-trigger came from futex fuzzing and stress testing rather than a weaponized exploit. The vulnerability allows local users to cause a kernel warning and process disruption on the affected CPU, with no confidentiality or integrity impact.

No verified public proof-of-concept code is available for this CVE. Refer to the upstream commits for the precise sequence and the corrective patch.

Detection Methods for CVE-2026-31555

Indicators of Compromise

Kernel log entries containing WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting accompanied by a task name pattern such as futex_lock_pi_s/<pid>.
Repeated kernel warnings or backtraces referencing futex_lock_pi_atomic and attach_to_pi_owner under workloads that exercise PI futexes.
Unexplained process stalls or task exits on hosts running fuzzers, container workloads, or real-time applications that rely heavily on PI mutexes.

Detection Strategies

Parse dmesg and journalctl -k for the specific wait_for_owner_exiting warning string and forward matches to a central log platform.
Inventory running kernel versions against the affected stable branches listed in the upstream advisories and flag hosts missing the fix commits.
Audit user-space workloads that invoke FUTEX_LOCK_PI and correlate spikes in PI-futex syscall rates with kernel warnings.

Monitoring Recommendations

Stream kernel messages to a centralized logging or SIEM pipeline and alert on any kernel/futex/core.c warning signatures.
Track kernel package versions across the fleet and enforce drift detection so unpatched hosts surface in configuration management.
Monitor for repeated process crashes or task hung warnings on multi-tenant Linux hosts, which can indicate triggering of the stale-pointer path.

How to Mitigate CVE-2026-31555

Immediate Actions Required

Apply the upstream stable kernel updates that include the futex retry-path fix and reboot affected systems into the patched kernel.
Identify hosts running affected kernel versions and prioritize patching on multi-tenant systems where untrusted local users have shell access.
Where immediate patching is not possible, restrict local shell access on shared hosts and isolate untrusted workloads at the container or VM boundary.

Patch Information

The Linux kernel maintainers have released fixes across multiple stable branches. The fix resets the local exiting pointer to NULL on the retry path, aligning the behavior with the requeue_pi code path. Apply the relevant commit from your distribution's backport: Kernel Patch 210d36d, Kernel Patch 33095ae3, Kernel Patch 5e8e06b, Kernel Patch 71112e6, Kernel Patch 7475dfa, Kernel Patch 92e47ad, Kernel Patch de7c0c0, and Kernel Patch e7824ec.

Workarounds

No supported source-level workaround exists; the only complete remediation is applying the upstream fix.
Limit local user access on shared kernels and avoid running untrusted code on hosts that cannot be patched promptly.
Constrain workloads that heavily exercise FUTEX_LOCK_PI through cgroup or scheduling policies on affected hosts until kernels are updated.

bash

# Verify running kernel and apply distribution updates
uname -r

# Debian/Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r | cut -d- -f3-)

# RHEL/Fedora
sudo dnf update kernel

# Reboot into the patched kernel
sudo reboot