CVE-2026-90003

A flaw was found in the Linux kernel's futex component. A race condition during the FUTEX_CMP_REQUEUE_PI operation can lead to a use-after-free vulnerability in the rcuwait mechanism. This issue could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other system instability.

A use-after-free in the futex requeue PI path can occur on PREEMPT_RT because futex_requeue_pi_complete can call rcuwait_wake_up on q.requeue_wait after the waiter has left the syscall and the stack allocated futex_q is no longer valid. A local process can trigger the vulnerable path through FUTEX_CMP_REQUEUE_PI by racing an early wakeup from timeout or signal with a PI requeue operation. For the CVSS the PR:L is used because an unprivileged local process can reach the futex syscall path and can create waiter and requeue activity, while no network access is involved. The base impact is at least local denial of service via KASAN report or kernel crash. For the paranoid score, the UAF on a kernel stack object makes limited or full confidentiality and integrity impact defensible and the issue should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.