CVE-2026-90003: Linux Kernel Use-After-Free Vulnerability

CVE-2026-90003 Overview

CVE-2026-90003 is a use-after-free vulnerability in the Linux kernel futex subsystem. The flaw affects the FUTEX_CMP_REQUEUE_PI operation on kernels built with PREEMPT_RT. A race condition between an early wakeup and a priority-inheritance requeue can trigger a slab-out-of-bounds access in futex_requeue_pi_complete() when it calls rcuwait_wake_up(). The futex_q structure lives on the waiter's stack, so the requeue task can dereference freed stack memory after the waiter returns from the syscall. KASAN reports confirm the out-of-bounds condition. Local, low-privileged users can trigger the race on affected systems.

Critical Impact
A local attacker can trigger memory corruption in kernel space, leading to potential privilege escalation, denial of service, or arbitrary kernel code execution on PREEMPT_RT Linux systems.

Affected Products

Linux kernel builds with PREEMPT_RT enabled that expose FUTEX_CMP_REQUEUE_PI
Stable branches referenced by kernel commits 220ee9e, 244f301, 7d15591, 81aadbd, a3b8d46, and e4a4ccf
Real-time Linux distributions and workloads relying on PI futex requeue semantics

Discovery Timeline

2026-09-16 - CVE-2026-90003 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90003

Vulnerability Analysis

The vulnerability lives in the priority-inheritance requeue path of the Linux futex implementation. futex_wait_requeue_pi() allocates a futex_q on the waiter's stack. Under PREEMPT_RT, the requeue task and the waiter can execute concurrently. The waiter can be woken early by a signal or timeout while the requeue task transitions requeue_state through Q_REQUEUE_PI_IN_PROGRESS, Q_REQUEUE_PI_WAIT, and finally Q_REQUEUE_PI_LOCKED.

Once futex_requeue_pi_complete() publishes the Q_REQUEUE_PI_LOCKED state via cmpxchg, the waiter observes the state in rcuwait_wait_event(), skips the schedule(), and returns from the syscall. The waiter's stack frame is reclaimed. The requeue task then invokes rcuwait_wake_up(&q->requeue_wait) on freed memory, producing the KASAN slab-out-of-bounds report.

Root Cause

The root cause is an ordering flaw between the state publication and the rcuwait wake operation. futex_requeue_pi_complete() releases the waiter before it finishes touching the waiter-owned rcuwait object. Because futex_q is stack-allocated, releasing the waiter invalidates the object that the requeue task still references. This is a classic use-after-free ([CWE-416]) driven by a race condition ([CWE-362]).

Attack Vector

Exploitation requires local access and the ability to issue futex syscalls. An attacker crafts contending threads that call FUTEX_CMP_REQUEUE_PI while a partner thread waits with futex_wait_requeue_pi(). Timely delivery of a signal or timeout races the requeue's state transition. When the race wins, the kernel writes into a reclaimed stack slot on behalf of the requeue task. Attackers can influence what occupies that reclaimed memory to steer the write toward privilege escalation primitives.

The upstream fix skips rcuwait_wake_up() in the Q_REQUEUE_PI_LOCKED case. The wake_up_state() call already performed by requeue_pi_wake_futex() handles the wake safely because it uses the task pointer saved before futex_requeue_pi_complete(), and the task pointer is RCU protected under futex_hash_bucket::lock. See the kernel patches referenced under Kernel Git Commit 220ee9e and Kernel Git Commit a3b8d46 for the exact source changes.

Detection Methods for CVE-2026-90003

Indicators of Compromise

KASAN reports naming slab-out-of-bounds in futex_requeue_pi_complete() or rcuwait_wake_up().
Kernel oops or panic traces referencing futex_wait_requeue_pi, requeue_pi_wake_futex, or rcuwait_wait_event on PREEMPT_RT builds.
Unexplained process crashes tied to threads using FUTEX_CMP_REQUEUE_PI.

Detection Strategies

Enable KASAN and lockdep on test kernels to surface the race during workload validation.
Audit kernel logs for repeated futex-related warnings that correlate with real-time workloads.
Correlate syscall telemetry showing high FUTEX_CMP_REQUEUE_PI frequency with signal-driven wakeups from the same PIDs.

Monitoring Recommendations

Forward dmesg and journald kernel facility events into a centralized data lake for correlation across fleets.
Alert on any user-space process triggering repeated kernel warnings from the futex subsystem.
Track kernel version and CONFIG_PREEMPT_RT status per host in your configuration management inventory.

How to Mitigate CVE-2026-90003

Immediate Actions Required

Inventory all Linux hosts running PREEMPT_RT kernels and prioritize them for patching.
Apply the stable kernel updates that include the futex requeue PI fix and reboot affected systems.
Restrict local shell and container escape paths so untrusted users cannot invoke arbitrary futex syscalls.

Patch Information

The fix is committed upstream and backported to stable branches. Review and apply the changes tracked in Kernel Git Commit 220ee9e, Kernel Git Commit 244f301, Kernel Git Commit 7d15591, Kernel Git Commit 81aadbd, Kernel Git Commit a3b8d46, and Kernel Git Commit e4a4ccf. Consume vendor kernel packages that include these commits rather than cherry-picking manually on production systems.

Workarounds

Where feasible, run workloads on a non-PREEMPT_RT kernel until the patched version is deployed.
Reduce local attack surface by tightening seccomp profiles to limit futex op codes for untrusted processes.
Isolate real-time workloads from multi-tenant users through namespaces, cgroups, and mandatory access control policies.

bash

# Verify running kernel and PREEMPT_RT status
uname -r
grep -E 'PREEMPT(_RT)?' /sys/kernel/debug/sched_features 2>/dev/null || \
  cat /sys/kernel/realtime 2>/dev/null

# Restrict futex syscall reachability via a seccomp allowlist wrapper
# (example: block FUTEX_CMP_REQUEUE_PI for a specific service)
systemctl edit my-service.service
# Add under [Service]:
# SystemCallFilter=~futex_waitv
# SystemCallFilter=@system-service