CVE-2026-74658: Linux Kernel Race Condition Vulnerability

CVE-2026-74658 Overview

CVE-2026-74658 is a race condition in the Linux kernel's robust futex implementation. The flaw allows waiting tasks to sleep indefinitely on a free futex when a specific sequence of unlock, wakeup, kill, and fast-path re-acquire operations occurs. The kernel fails to keep the FUTEX_WAITERS bit consistent, breaking the wakeup chain for remaining waiters. A previous partial fix in commit ca16d5bee598 did not address the case where a third task re-acquires the futex through the uncontended fast path before the woken waiter can respond.

Critical Impact
Threads waiting on a robust futex can hang indefinitely, leading to application deadlock and denial-of-service conditions in multi-threaded Linux workloads.

Affected Products

Linux kernel (stable branches receiving the referenced backport commits)
Distributions shipping affected upstream kernel versions
Multi-threaded userspace applications relying on robust futex semantics (for example, glibc pthreads with PTHREAD_MUTEX_ROBUST)

Discovery Timeline

2026-08-22 - CVE-2026-74658 published to NVD
2026-08-22 - Last updated in NVD database

Technical Details for CVE-2026-74658

Vulnerability Analysis

The vulnerability is a [Race Condition] in the kernel futex subsystem, specifically in robust futex exit processing. A robust futex unlock writes zero over the entire futex word, wiping the FUTEX_WAITERS bit, and then wakes exactly one waiter through FUTEX_WAKE(1). The protocol assumes the woken task will either acquire the futex or re-arm FUTEX_WAITERS before sleeping again. When the woken task is killed before it can complete either action, robust exit processing is expected to forward the wakeup to the next waiter.

The forwarding logic breaks when a third task acquires the futex through the uncontended fast path between the unlock and the exit handler. Robust exit processing observes that the futex is owned by another task and takes no action. The new owner later unlocks a futex that shows no FUTEX_WAITERS bit and wakes no one. Remaining waiters block forever behind a free futex.

Root Cause

The root cause is inconsistent maintenance of the FUTEX_WAITERS flag across the unlock, wake, kill, and fast-path acquire sequence. The kernel treats the single wakeup as a one-shot notification without a fallback path to re-establish the waiters bit when the notification recipient dies. The prior mitigation in commit ca16d5bee598 ("futex: Prevent robust futex exit race") only handled a subset of scenarios and did not account for concurrent fast-path acquisition by a third thread.

Attack Vector

Exploitation requires local execution of multi-threaded code that uses robust futexes. An attacker or a buggy workload can orchestrate the ordering of unlock, wake, thread termination, and re-acquire operations to trigger the lost wakeup. The result is indefinite thread stalls, which can be leveraged for local denial of service against services that share robust mutexes across processes, including database engines and IPC frameworks.

The fix augments robust list exit processing so that when the futex word is owned by another thread and FUTEX_WAITERS is not set, the kernel still performs the additional wakeup to unblock remaining waiters. See the Linux Kernel Commit 33bfa85 for the reference implementation.

Detection Methods for CVE-2026-74658

Indicators of Compromise

Multi-threaded processes accumulating threads in the D (uninterruptible sleep) or S state with stack traces terminating in futex_wait_queue or do_futex.
Applications using PTHREAD_MUTEX_ROBUST mutexes reporting unexplained hangs after a thread crash or SIGKILL.
Kernel stack samples from perf or /proc/<pid>/stack showing waiters blocked on a futex whose userspace value is zero.

Detection Strategies

Monitor running kernel versions against the fixed stable commits listed in the vendor references and flag hosts still on vulnerable revisions.
Instrument critical services with watchdogs that detect thread starvation on robust mutexes and emit telemetry when wait times exceed expected bounds.
Correlate application-level deadlock signatures with concurrent thread termination events (SIGKILL, OOM kills) on the same host.

Monitoring Recommendations

Ingest kernel version inventory and syslog into a central telemetry pipeline to track patch coverage across the fleet.
Alert on repeated hung_task warnings in dmesg referencing futex wait paths.
Track OOM-killer and abnormal process termination events adjacent to hangs in multi-threaded workloads.

How to Mitigate CVE-2026-74658

Immediate Actions Required

Identify Linux hosts running kernel versions that predate the referenced stable backport commits and prioritize them for patching.
Apply distribution-supplied kernel updates that incorporate the robust futex exit race fix.
Reboot systems after kernel upgrade to activate the corrected futex code paths.

Patch Information

The upstream fix has been merged and backported across multiple stable branches. Relevant commits include Linux Kernel Commit 33bfa85, Linux Kernel Commit 6d4514c, Linux Kernel Commit 7b8c532, Linux Kernel Commit 7cf710e, Linux Kernel Commit 83b0f71, Linux Kernel Commit 9256286, Linux Kernel Commit a1c2b7b, and Linux Kernel Commit aa5c571. A more complete solution based on in-kernel unlock of contended robust futexes is expected in subsequent mainline releases.

Workarounds

No supported workaround exists in userspace; patch the kernel to the fixed revision.
Where patching must be deferred, minimize reliance on robust mutexes shared across processes and avoid forcibly terminating threads that hold robust futexes.
Increase application-level watchdogs and health checks to detect and recover hung worker threads until the kernel is updated.

bash

# Verify running kernel and confirm patch status via distribution advisories
uname -r
# Example: identify installed kernel package on Debian/Ubuntu
dpkg -l | grep linux-image
# Example: identify installed kernel package on RHEL/Fedora
rpm -q kernel