CVE-2026-80777: Linux Kernel Futex Race Condition Vulnerability

CVE-2026-80777 Overview

CVE-2026-80777 is a race condition in the Linux kernel's priority-inheritance futex (futex/pi) subsystem. The flaw occurs during the exec() system call, where the check comparing a waiter's mm (memory descriptor) with the owner's mm becomes unreliable. Between the point where futex_exec_release() resets tsk::futex::exit_state to OK and the point where the task's mm pointer is swapped, the private futex validation logic returns an incorrect result. The affected mm is about to be swapped out and freed, creating a window where futex state can reference stale memory.

Critical Impact
The race window between robust list cleanup and mm swap in exec() allows private futex operations to reference an mm that is being torn down, potentially leading to memory corruption or undefined kernel behavior.

Affected Products

Linux kernel (upstream) — versions prior to the commits listed in the patch information
Stable kernel branches receiving backports referenced by commits 0478bc6bf197, c5f0bc9fd1ce, d7944cee62ec, and fdf538b2e696
Distribution kernels derived from affected upstream versions

Discovery Timeline

2026-09-04 - CVE-2026-80777 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80777

Vulnerability Analysis

The vulnerability resides in the private futex path used by priority-inheritance (futex/pi) operations. Private futexes are keyed by the task's mm_struct, which is stored in the futex_key and copied into pi_state. Kernel code compares the waiter's mm against the owner's mm to validate operations on a private futex.

During exec(), the kernel calls exec_release_mm(), which invokes futex_exec_release(). That function sets tsk::futex::exit_state to EXITING, runs cleanup_robust_list(), then resets tsk::futex::exit_state back to OK. Only afterward does exec() replace tsk::mm with the newly constructed mm for the executed binary.

Between the reset to OK and the mm swap, the futex validation logic sees a task whose futex state appears live but whose mm is about to be torn down. Any concurrent private futex operation observing this window operates on stale futex state tied to memory that is being freed. This is a race condition ([CWE-362]) and a time-of-check to time-of-use flaw.

Root Cause

The root cause is insufficient state transitions in futex_exec_release(). Restoring exit_state to OK before the mm swap leaves a gap where the mm-equality check is no longer meaningful. The fix sets tsk::futex::exit_state to FUTEX_STATE_DEAD in futex_exec_release() and only transitions it back to FUTEX_STATE_OK after the new mm is installed. From a futex perspective, the task is treated as dead across the entire cleanup-through-mm-swap interval.

Attack Vector

Exploitation requires local code execution and precise timing to hit the narrow race window during another process's exec(). An attacker with the ability to run code on the target system could arrange concurrent private futex pi operations against a task performing exec(). Successful exploitation depends on kernel version, scheduler behavior, and workload conditions, making reliable weaponization non-trivial. No public proof-of-concept is referenced in the advisory data.

For implementation-level detail, see the upstream fixes at Kernel Git Commit d7944cee62ec and Kernel Git Commit fdf538b2e696.

Detection Methods for CVE-2026-80777

Indicators of Compromise

Unexpected kernel oops, WARN_ON, or KASAN use-after-free reports referencing futex_pi, pi_state, or mm_struct teardown paths.
Kernel panics correlating with heavy exec() activity combined with priority-inheritance futex use by multithreaded workloads.
Unexplained process termination or scheduler anomalies on kernels that have not applied the referenced stable commits.

Detection Strategies

Inventory running kernel versions across Linux endpoints and servers, and compare against the fixed versions referenced in the stable git commits.
Enable KASAN and lockdep on test kernels to surface race-related memory corruption during regression testing.
Correlate kernel ring-buffer messages (dmesg) with process execution telemetry to identify crashes tied to exec() and futex code paths.

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a central log platform and alert on WARN, BUG, or KASAN entries referencing futex or mm symbols.
Monitor for repeated crashes of the same workload on unpatched kernels, which may indicate active exploitation attempts or reliability issues.
Track kernel package versions through configuration management to confirm patch coverage across the fleet.

How to Mitigate CVE-2026-80777

Immediate Actions Required

Identify all Linux systems running kernel versions that predate the upstream fix commits referenced in the advisory.
Apply vendor-supplied kernel updates from your Linux distribution as soon as they become available.
Prioritize multi-tenant systems, container hosts, and shared build infrastructure where untrusted local code execution is more likely.

Patch Information

The upstream fix modifies futex_exec_release() to set tsk::futex::exit_state to FUTEX_STATE_DEAD during cleanup and only restore FUTEX_STATE_OK after tsk::mm has been switched. Relevant upstream commits are:

Consult your distribution's security tracker for backported package versions.

Workarounds

No supported workaround eliminates the race without patching. Kernel updates are the only reliable remediation.
Reduce local attack surface by restricting untrusted user access on affected hosts until patches are deployed.
Constrain workloads that combine heavy exec() activity with priority-inheritance futex use where feasible during the patch window.

bash

# Verify current kernel version and pending updates
uname -r

# Debian / Ubuntu
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/-generic//')

# RHEL / CentOS / Rocky / Alma
sudo dnf update kernel

# Reboot into the patched kernel
sudo systemctl reboot