CVE-2026-74658

A flaw was found in the Linux kernel's futex subsystem. A race condition during robust futex unlock operations can occur when a process waiting on a futex is killed before it can acquire the futex, and another process subsequently re-acquires the futex through a fast path. This can lead to a situation where other processes waiting on the same futex are not woken up and remain in an indefinite sleep state, resulting in a Denial of Service (DoS) for those processes.

A moderate-impact flaw was found in the Linux kernel's futex subsystem on Red Hat Enterprise Linux and Red Hat In-Vehicle OS. A race condition in robust futex exit handling can lose a one-shot wakeup: when a robust futex unlock wakes a single waiter and that waiter is killed before it can either acquire the futex or re-arm FUTEX_WAITERS, and a third task re-acquires the futex through the uncontended fast path in the meantime, the wakeup notification is lost. The new owner later unlocks without seeing FUTEX_WAITERS and wakes nobody, so the remaining waiters sleep forever behind a free futex. A local attacker with low privileges who can run code participating in the affected futex synchronization could trigger this race, which requires precise timing to exploit, to cause a denial of service by leaving processes in an indefinite sleep; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10 (kernel) streams and the Red Hat In-Vehicle OS kernel streams, the fix is deferred because the issue has availability-only impact and requires local code execution and a difficult-to-trigger timing race to exploit; it will be addressed in a future update. The residual risk of deferring is a local denial of service in which threads using robust futexes hang permanently.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.