5.5

CVE-2026-31555: futex: Clear stale exiting pointer in futex_lock_pi() retry path

Modified
AliasesUBUNTU-CVE-2026-31555DEBIAN-CVE-2026-31555
Published 24-04-2026Last modified 15-10-2026

Vulnerability summary

CVE-2026-31555 is a medium (CVSS 5.5) vulnerability in linux. EPSS estimates a 0.13% chance of exploitation in the next 30 days, higher than 2.5% of scored vulnerabilities.

Priority
Routine

Not severe (CVSS 5.5, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?
CVSS score
5.5/10
010
Medium · v3.1 (NVD)
EPSS score
0.13%
0%100%
Low · -0.04 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 41 · Related 38
MGASA-2026-0108MGASA-2026-0110OPENSUSE-SU-2026:21388-1RHSA-2026:51035SUSE-SU-2026:22433-1SUSE-SU-2026:22436-1

Timeline

  1. 24-04-2026
    PublishedVulnerability first disclosed.
  2. 15-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: futex: Clear stale exiting pointer in futex_lock_pi() retry path Fuzzying/stressing futexes triggered: WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524 When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY and stores a refcounted task pointer in 'exiting'. After wait_for_owner_exiting() consumes that reference, the local pointer is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a different error, the bogus pointer is passed to wait_for_owner_exiting(). CPU0 CPU1 CPU2 futex_lock_pi(uaddr) // acquires the PI futex exit() futex_cleanup_begin() futex_state = EXITING; futex_lock_pi(uaddr) futex_lock_pi_atomic() attach_to_pi_owner() // observes EXITING *exiting = owner; // takes ref return -EBUSY wait_for_owner_exiting(-EBUSY, owner) put_task_struct(); // drops ref // exiting still points to owner goto retry; futex_lock_pi_atomic() lock_pi_update_atomic() cmpxchg(uaddr) *uaddr ^= WAITERS // whatever // value changed return -EAGAIN; wait_for_owner_exiting(-EAGAIN, exiting) // stale WARN_ON_ONCE(exiting) Fix this by resetting upon retry, essentially aligning it with requeue_pi.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.13%

Chance of exploitation in the next 30 days

Percentile

3%

Versus all other CVEs

30-day change

Decrease -0.04 pp

From 0.17% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu157 products
  • linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-136.136
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1061.64
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < e7824ec168d2ac883a213cd1f4d6cc0816002a85 | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 5e8e06bf8909e79b4acd950cf578cfc2f10bbefa | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < de7c0c04ad868f2cee6671b11c0a6d20421af1da | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 7475dfad10a05a5bfadebf5f2499bd61b19ed293 | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 92e47ad03e03dbb5515bdf06444bf6b1e147310d | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 71112e62807d1925dc3ae6188b11f8cfc85aec23 | ≥ 3ef240eaff36b8119ac9e2ea17cbf41179c930ba, < 210d36d892de5195e6766c45519dfb1e65f3eb83 | f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463 | cf16e42709aa86aa3e37f3acc3d13d5715d90096 | 61fa9f167caaa73d0a7c88f498eceeb12c6fa3db | 7874eee0130adf9bee28e8720bb5dd051089def3 | fc3b55ef2c840bb2746b2d8121a0788de84f7fac | ≥ 4.4.255, < 4.5 | ≥ 4.9.255, < 4.10 | ≥ 4.14.158, < 4.15 | ≥ 4.19.172, < 4.20 | ≥ 5.4.1, < 5.5 | 5.5
  • linux_kernel≥ 4.4.255, < 4.5 | ≥ 4.9.255, < 4.10 | ≥ 4.14.158, < 4.15 | ≥ 4.19.172, < 4.20 | ≥ 5.4.1, < 5.5 | ≥ 5.5.1, < 5.10.253 | ≥ 5.11, < 5.15.203 | ≥ 5.16, < 6.1.168 | ≥ 6.2, < 6.6.131 | ≥ 6.7, < 6.12.80 | ≥ 6.13, < 6.18.21 | ≥ 6.19, < 6.19.11 | 5.5 | 7.0:rc1 | 7.0:rc2 | 7.0:rc3 | 7.0:rc4 | 7.0:rc5 | 7.0:rc6 | 7.0:rc7
Debian1 product
  • linux< 6.1.170-1 | < 6.12.85-1 | < 6.19.11-1

3 vendors · 160 products

References

43 links
Show all 43 references