CVE-2026-53163: Linux Kernel rtmutex Null Pointer Dereference Denial of Service

Technical summary

The vulnerability exists in the Linux kernel's rtmutex implementation, specifically in the interaction between task_blocks_on_rt_mutex(), rt_mutex_start_proxy_lock(), and remove_waiter() functions. When deadlock is detected during proxy lock acquisition, task_blocks_on_rt_mutex() may decline to enqueue a waiter, leaving the waiter->task field uninitialized (nil). Later, if remove_waiter() is called on this unenqueued waiter, it attempts to dereference pointers in an invalid waiter structure, triggering a null pointer dereference. The root cause traces to two issues: (1) commit 3bfdc63936dd changed remove_waiter() to use waiter::task instead of current, making the nil state fatal; and (2) commit 1a1fb985f2e2 moved the remove_waiter() call into the rt_mutex_start_proxy_lock() wrapper without properly constraining when it should execute. The fix requires tightening the conditional logic in rt_mutex_start_proxy_lock() to skip remove_waiter() when the waiter was never enqueued, and ensuring deadlock paths initialize the waiter structure correctly.

Business impact

This vulnerability allows local denial of service attacks. An unprivileged user can crash the kernel by exploiting specific futex operations, taking down services and requiring system restart. For systems running multi-tenant workloads, container environments, or where untrusted local code execution is possible, this presents a real availability risk. The impact is limited to availability; confidentiality and integrity are not compromised. Organizations relying on kernel stability for critical services should prioritize patching.

Affected systems

All Linux kernel versions incorporating the affected rtmutex code are impacted. The vulnerability depends on specific commit sequences; systems running kernels with commit 3bfdc63936dd (which changed waiter::task handling) and commit 1a1fb985f2e2 (which reorganized remove_waiter() calls) are most directly affected. The exact vulnerable range should be verified against your kernel version against the Linux kernel commit history. Distributions that backport rtmutex changes may also be affected.

Exploitability

Exploitability is moderate. The attack requires local code execution with unprivileged user privileges (no root required). The FUTEX_CMP_REQUEUE_PI operation and specific timing conditions must be triggered, making reliable reproduction feasible but not trivial. No remote exploitation is possible. The vulnerability is not listed in the CISA KEV catalog, indicating no evidence of active, widespread exploitation in the wild at this time.

Remediation

Patch the Linux kernel to a version that includes the fix for this rtmutex vulnerability. The fix involves conditionalizing the remove_waiter() call in rt_mutex_start_proxy_lock() to execute only when the waiter was actually enqueued, and ensuring that deadlock detection paths properly initialize waiter structures. Consult your Linux distribution's security advisory for the specific patched kernel version. For systems that cannot immediately patch, restricting local code execution privileges and disabling futex operations (if feasible for your workload) can reduce risk.

Patch guidance

Contact your Linux distribution's security team for the patched kernel version specific to your release. Major distributions (Red Hat, Debian, Ubuntu, SUSE, etc.) will issue kernel security updates that incorporate this fix. Verify patch availability through your distribution's security advisory portal. Testing in a staging environment before production deployment is recommended, as kernel patches require reboot.

Detection guidance

Monitor system logs for kernel crashes or reboots coinciding with futex-related system calls, particularly FUTEX_CMP_REQUEUE_PI operations from untrusted processes. Kernel oops messages containing stack traces from remove_waiter(), rt_mutex_start_proxy_lock(), or futex_requeue() functions indicate exploitation or triggering of this vulnerability. Security Information and Event Management (SIEM) systems should alert on unexpected kernel panic events from systems running vulnerable kernels. Preemptively identify running kernel versions susceptible to this issue for patch planning.

Why prioritize this

Although rated MEDIUM severity, this vulnerability warrants timely attention because: (1) it requires only local, unprivileged access to trigger, lowering the barrier to exploitation; (2) denial of service impacts are disruptive in production environments; (3) it is not yet widely exploited (not in KEV), providing a window to patch before attacker focus increases; and (4) the fix is straightforward and distributions are actively releasing patches. Prioritize systems hosting untrusted user code or multi-tenant workloads.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L) requiring an unprivileged user on the system; low attack complexity (AC:L) since triggering futex operations is accessible; no privilege escalation required (PR:L); no user interaction needed (UI:N); and impact scoped to the affected system only (S:U). The availability impact is high (A:H) because the kernel crash causes denial of service. Confidentiality and integrity are unaffected (C:N, I:N), capping the severity. The score appropriately reflects a local DoS threat that is serious for availability but does not lead to data breach or privilege escalation.

Frequently asked questions