CVE-2026-52977 Overview
CVE-2026-52977 is a race condition in the Linux kernel's futex subsystem affecting the requeue-PI (priority inheritance) code path. The flaw occurs when a waiting task exits early due to a signal or timeout while a second task concurrently performs a requeue operation. Under specific scheduling conditions, particularly on uniprocessor (UP) systems or when the requeueing task runs at higher priority, the interaction causes the system to live-lock. The kernel maintainers resolved the issue by removing the top-most waiter from the list when futex_requeue_pi_prepare() fails, allowing forward progress.
Critical Impact
Local unprivileged processes can trigger a kernel livelock through the futex requeue-PI path, resulting in a denial of service condition on affected Linux systems.
Affected Products
- Linux kernel versions containing the futex requeue-PI implementation prior to the fix
- Stable kernel branches receiving backports referenced in commits 0304d60, 0aacb6d, 4e0ed44, 69a7cfc, bc7304f, and e3f95b1
- Linux distributions shipping vulnerable kernel builds
Discovery Timeline
- 2026-06-24 - CVE-2026-52977 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52977
Vulnerability Analysis
The vulnerability resides in the kernel futex implementation, specifically in the wait-requeue-PI and requeue-PI interaction. Two tasks operate on shared futex hash buckets (hb1 and hb2). Task A invokes futex_wait_requeue_pi() and arms a timeout through futex_setup_timer(). Task B concurrently calls futex_requeue() and acquires both hash bucket locks.
When Task A's timeout or a signal fires, it enters futex_requeue_pi_wakeup_sync() and sets requeue_state = Q_REQUEUE_PI_IGNORE. Task A then blocks waiting for the hash bucket lock held by Task B. Task B observes the Q_REQUEUE_PI_IGNORE state in futex_requeue_pi_prepare(), returns -EAGAIN, drops both bucket locks via double_unlock_hb(), and retries.
Task A cannot complete its dequeue because the hash bucket lock remains contended. If Task B holds higher priority or the system is uniprocessor, Task A never gets scheduled to reclaim the lock. Task B busy-loops attempting requeue while Task A remains pinned, producing a system-wide livelock.
Root Cause
The root cause is an [Atomicity Violation / Race Condition] between the early-exit cleanup path in handle_early_requeue_pi_wakeup() and the retry loop in futex_requeue(). The waiter signals abandonment via requeue_state but cannot remove itself from the PI waiter list without the hash bucket lock that the requeueing task repeatedly reacquires.
Attack Vector
Exploitation requires local code execution to invoke futex syscalls. An unprivileged process can construct two threads, one calling futex_wait_requeue_pi with a short timeout and another performing futex_cmp_requeue_pi, scheduled such that the higher-priority requeuer starves the waiter. The result is a denial of service through kernel livelock rather than memory corruption or privilege escalation.
No verified public exploit code is available. The behavior is described in the upstream commit messages referenced by the kernel.org git tree.
Detection Methods for CVE-2026-52977
Indicators of Compromise
- Sustained 100% CPU utilization on a single core attributable to a kernel thread looping in futex_requeue()
- Soft lockup or RCU stall warnings in dmesg referencing futex symbols such as futex_proxy_trylock_atomic or double_unlock_hb
- Processes stuck in uninterruptible sleep (D state) waiting on futex hash bucket locks
Detection Strategies
- Monitor kernel log output for soft lockup and hung task messages correlated with futex call stacks
- Use perf or bpftrace to profile time spent in futex_requeue() retry loops on production hosts
- Inventory running kernel versions against the fixed commit hashes and flag systems lacking the patch
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized log platform and alert on lockup keywords
- Track per-CPU runqueue latency and involuntary context switch counts for anomalous spikes
- Audit kernel package versions across the fleet on a scheduled basis to verify patch deployment
How to Mitigate CVE-2026-52977
Immediate Actions Required
- Identify all Linux hosts running kernels predating the fix commits and prioritize them for update
- Apply vendor-supplied kernel updates that incorporate the upstream futex requeue-PI fix
- Reboot patched systems to load the corrected kernel image, since the change is in core kernel code
Patch Information
The upstream fix removes the top-most waiter from the list when futex_requeue_pi_prepare() fails and lets the waiter conditionally remove itself in handle_early_requeue_pi_wakeup(). The patch is available across multiple stable branches via the following commits: Kernel Git Commit 0304d60, Kernel Git Commit 0aacb6d, Kernel Git Commit 4e0ed44, Kernel Git Commit 69a7cfc, Kernel Git Commit bc7304f, and Kernel Git Commit e3f95b1.
Workarounds
- No reliable userspace workaround exists because the race lives in kernel futex code; apply the kernel update
- Limit execution of untrusted local code on multi-tenant systems until patches are deployed
- Consider enabling watchdog-based reboot policies so that livelocked nodes recover automatically
# Verify the running kernel against the patched commits
uname -r
zcat /proc/config.gz | grep -E 'CONFIG_FUTEX|CONFIG_RT_MUTEXES'
# After patching, confirm the fix is present in the source tree of your distribution
# by checking the changelog or backport metadata for the commit hashes above.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
