CVE-2026-53163

A flaw was found in the Linux kernel's rtmutex locking mechanism. A local attacker could trigger a null-pointer dereference by using the FUTEX_CMP_REQUEUE_PI operation. This vulnerability occurs because the remove_waiter() function is called when the waiter is not properly enqueued, leading to a system crash and a denial of service (DoS). This issue was detected by KASAN (Kernel Address Sanitizer).

This vulnerability is rated as Moderate severity because it requires local authenticated access with standard user privileges and results strictly in a denial of service without compromising confidentiality or integrity. On standard Red Hat Enterprise Linux environments, an unprivileged local user could induce a kernel panic by triggering priority-inheritance futex operations that improperly handle unqueued lock waiters. Because the flaw cannot be leveraged for arbitrary code execution or privilege escalation, the overall operational risk is limited to host availability.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.