CVE-2026-53166: Linux Kernel Futex DoS Vulnerability

CVE-2026-53166 Overview

CVE-2026-53166 is a NULL pointer dereference vulnerability in the Linux kernel's futex requeue subsystem. The flaw resides in the FUTEX_CMP_REQUEUE_PI operation, which fails to handle a self-deadlock condition correctly. When a non-top waiter that already owns the target priority-inheritance (PI) futex is requeued, task_blocks_on_rt_mutex() returns -EDEADLK before initializing waiter->task. The subsequent call to remove_waiter() inside rt_mutex_start_proxy_lock() then dereferences a NULL pointer, crashing the kernel.

Critical Impact
A local unprivileged user can trigger a kernel crash, resulting in denial of service on affected Linux systems.

Affected Products

Linux kernel (futex/requeue subsystem)
Distributions shipping vulnerable kernel versions prior to the upstream fix
Systems exposing FUTEX_CMP_REQUEUE_PI to untrusted local users

Discovery Timeline

2026-06-25 - CVE-2026-53166 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53166

Vulnerability Analysis

The Linux kernel's futex subsystem supports priority inheritance through PI futexes, which are backed by realtime mutexes (rt_mutex). The FUTEX_CMP_REQUEUE_PI operation moves waiters from one futex to another PI futex, transferring lock ownership semantics in the process.

The vulnerability manifests when a non-top waiter being requeued already owns the destination PI futex. This constitutes a self-deadlock scenario. In this path, task_blocks_on_rt_mutex() detects the deadlock and returns -EDEADLK early, before assigning the waiter->task field. Control then flows into rt_mutex_start_proxy_lock(), which calls remove_waiter() on the partially initialized waiter structure. Dereferencing the uninitialized waiter->task triggers a NULL pointer dereference and a kernel oops.

The upstream fix adds an explicit self-deadlock check for non-top waiters before invoking rt_mutex_start_proxy_lock(). This mirrors the existing top-waiter check already present in futex_lock_pi_atomic().

Root Cause

The root cause is an ordering issue in the rt_mutex proxy lock path [CWE-476]. The cleanup routine assumes waiter->task is always initialized when remove_waiter() is reached. The -EDEADLK early-return path violates this assumption, leaving the field as NULL and producing an unsafe dereference.

Attack Vector

The vulnerability is reachable from local userspace through the futex() syscall with the FUTEX_CMP_REQUEUE_PI operation. An attacker constructs a scenario where a non-top waiter holds ownership of the destination PI futex and then issues the requeue operation. No special privileges are required to invoke the syscall, making the issue exploitable by any local user with the ability to run code on the system.

The primary impact is denial of service through kernel crash. No public proof-of-concept exploit or evidence of in-the-wild exploitation is recorded for this CVE.

Detection Methods for CVE-2026-53166

Indicators of Compromise

Kernel oops or panic messages referencing remove_waiter, rt_mutex_start_proxy_lock, or futex_requeue in dmesg or /var/log/kern.log
Unexpected system reboots or task crashes on hosts where untrusted local users can invoke the futex syscall
NULL pointer dereference stack traces originating in the kernel's rt_mutex code paths

Detection Strategies

Audit kernel crash dumps for stack frames showing rt_mutex_start_proxy_lock() calling into remove_waiter() with a NULL task pointer
Compare running kernel versions against the upstream commits 16f8e17184b3, 1f2f3f3eacd6, and 74e144274af3 to identify unpatched hosts
Enable kernel panic_on_oops in test environments to detect attempts to trigger the dereference during fuzzing or QA

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on oops signatures involving futex and rt_mutex symbols
Track patch state of the kernel package across the fleet using configuration management telemetry
Monitor for abnormal use of the futex syscall with FUTEX_CMP_REQUEUE_PI from non-administrative processes via auditd or eBPF tracing

How to Mitigate CVE-2026-53166

Immediate Actions Required

Apply the vendor kernel update containing the upstream futex self-deadlock check as soon as it is available for your distribution
Inventory all Linux hosts running kernels that include FUTEX_CMP_REQUEUE_PI support and prioritize multi-tenant or shared systems for patching
Restrict local code execution on production systems where the patched kernel cannot yet be deployed

Patch Information

The fix has been merged upstream across multiple stable branches. Refer to the upstream commits for the exact change set:

Rebuild or update to a kernel that includes these commits and reboot affected systems to activate the fix.

Workarounds

Limit shell access and local code execution to trusted users until patches are deployed
Apply seccomp filters on untrusted workloads and containers to block the futex syscall operation FUTEX_CMP_REQUEUE_PI where it is not required
Enable kernel.panic_on_oops=1 paired with automated host recovery only in environments where rapid restart is preferable to a hung kernel

bash

# Example seccomp-style restriction concept and panic configuration
sysctl -w kernel.panic_on_oops=1
sysctl -w kernel.panic=10

# Verify running kernel version against patched releases
uname -r