CVE-2026-43499linux Use-After-Free
kernel: rtmutex: Use waiter::task instead of current in remove_waiter()
Published May 21, 2026 · Updated Oct 16, 2026 · Also known as DEBIAN-CVE-2026-43499, ROOT-OS-DEBIAN-11-CVE-2026-43499, ROOT-OS-DEBIAN-12-CVE-2026-43499, ROOT-OS-UBUNTU-2204-CVE-2026-43499, ROOT-OS-UBUNTU-2404-CVE-2026-43499, UBUNTU-CVE-2026-43499
Key Facts
Patch immediately- CVE-2026-43499 is a high-severity vulnerability (CVSS 8.5 v4) affecting linux-6.1 (debian), linux (debian), rootio-linux and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. A public exploit is reported by tracking sources, but no code link is listed yet.
- EPSS estimates a 0.8% probability of exploitation in the next 30 days.
- Fixed versions are available, including bpftool 1:6.1.175-219.357.amzn2023, bpftool 4.18.0-553.143.1.el8_10, bpftool 5.15.0-322.203.3.3.el8uek.
- Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Scores
CVSS v4
8.5
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS (30-day exploit likelihood)
0.8%
Higher than 55.3% of all scored CVEs
Exploit maturity
Proof of concept
ATLAS score
51/100
Publication score, see How it works
Exploitation Verdict
KEV listed
Not listed
Federal due date
None
No federal due date
Ransomware use
Not reported
Attributed actors
None named
Exploit & Defence Guidance
Exploit maturity
Proof of concept
Public exploit code
10
Proof-of-concept links
In-the-wild evidence
0
Reports of active use
Advisories And Exploit References
Description
In the Linux kernel, the following vulnerability has been resolved:
rtmutex: Use waiter::task instead of current in remove_waiter()
remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().
In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems:
1) the rbtree dequeue happens without waiter::task::pi_lock being held
2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around.
3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task
Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems.
[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]
Affected Products
4,589 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| linux-6.1debian | See advisory | 6.1.176-1~deb11u1 |
| linuxdebian | See advisory | 6.1.176-1 |
| rootio-linuxrootio | See advisory | 5.10.251-5.root.io.90 |
| bpftoolubuntu | See advisory | 7.7.0+7.0.0-27.27 |
| hv-kvp-daemon-initubuntu | See advisory | 3.13.0.215.225 |
Patched Releases
bpftool
1:6.1.175-219.357.amzn2023, 4.18.0-553.143.1.el8_10, 5.15.0-322.203.3.3.el8uek, 5.15.0-322.203.3.3.el9uek, 5.15.0-323.211.3.3.el8uek, 5.15.0-323.211.3.3.el9uek, 6.1.177-1.ph5, 7.7.0+7.0.0-27.27
bpftool6.12
1:6.12.88-119.157.amzn2023
bpftool6.18
1:6.18.30-61.116.amzn2023
cluster-md-kmp-64kb
6.12.0-160000.34.1
cluster-md-kmp-azure
6.12.0-160000.34.1
cluster-md-kmp-default
4.12.14-122.317.1, 5.14.21-150400.24.222.1, 5.14.21-150500.55.169.1, 6.12.0-160000.34.1, 6.4.0-150600.23.115.1, 6.4.0-150700.53.60.1
cluster-md-kmp-rt
6.12.0-160000.34.1, 6.4.0-150700.7.59.2
dlm-kmp-64kb
6.12.0-160000.34.1
dlm-kmp-azure
6.12.0-160000.34.1
dlm-kmp-default
4.12.14-122.317.1, 5.14.21-150400.24.222.1, 5.14.21-150500.55.169.1, 6.12.0-160000.34.1, 6.4.0-150600.23.115.1, 6.4.0-150700.53.60.1
dlm-kmp-rt
6.12.0-160000.34.1, 6.4.0-150700.7.59.2
dtb-allwinner
6.12.0-160000.34.1
dtb-altera
6.12.0-160000.34.1
dtb-amazon
6.12.0-160000.34.1
dtb-amd
6.12.0-160000.34.1
dtb-amlogic
6.12.0-160000.34.1
dtb-apm
6.12.0-160000.34.1
dtb-apple
6.12.0-160000.34.1
dtb-arm
6.12.0-160000.34.1
dtb-broadcom
6.12.0-160000.34.1
dtb-cavium
6.12.0-160000.34.1
dtb-exynos
6.12.0-160000.34.1
dtb-freescale
6.12.0-160000.34.1
dtb-hisilicon
6.12.0-160000.34.1
dtb-lg
6.12.0-160000.34.1
Timeline
Publicly disclosed
May 21, 2026
Last updated
Oct 16, 2026
Weakness Type
- CWE-416 Use After Free
- CWE-825 Expired Pointer Dereference
References
- advisorycve.org · CVERecord
- advisorynvd.nist.gov · CVE-2026-43499
- advisorysecurity-tracker.debian.org · CVE-2026-43499
- advisoryubuntu.com · CVE-2026-43499
- advisoryRHSA-2026:37728
FAQ
Common Questions.
In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().
Affected: linux-6.1 (debian); linux (debian); rootio-linux, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
A public exploit is reported by tracking sources, but no code link is listed yet.
Fixed versions are available, including bpftool 1:6.1.175-219.357.amzn2023, bpftool 4.18.0-553.143.1.el8_10, bpftool 5.15.0-322.203.3.3.el8uek.
Brandefense priority: patch immediately, because public exploit code exists for a high-severity flaw.
Is CVE-2026-43499 On Your Attack Surface?
Brandefense matches it against the products discovered on your perimeter and opens a finding the day a CVE like this is listed.
Request A Demo