{"id":"CVE-2026-31555","state":"PUBLISHED","title":"futex: Clear stale exiting pointer in futex_lock_pi() retry path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi.","publishedAt":"2026-04-24T14:35:39.211Z","updatedAt":"2026-10-15T01:17:00.034Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"e7824ec168d2ac883a213cd1f4d6cc0816002a85","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"de7c0c04ad868f2cee6671b11c0a6d20421af1da","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"7475dfad10a05a5bfadebf5f2499bd61b19ed293","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"92e47ad03e03dbb5515bdf06444bf6b1e147310d","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"71112e62807d1925dc3ae6188b11f8cfc85aec23","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"210d36d892de5195e6766c45519dfb1e65f3eb83","versionType":"git"},{"version":"f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463","status":"affected","versionType":"git"},{"version":"cf16e42709aa86aa3e37f3acc3d13d5715d90096","status":"affected","versionType":"git"},{"version":"61fa9f167caaa73d0a7c88f498eceeb12c6fa3db","status":"affected","versionType":"git"},{"version":"7874eee0130adf9bee28e8720bb5dd051089def3","status":"affected","versionType":"git"},{"version":"fc3b55ef2c840bb2746b2d8121a0788de84f7fac","status":"affected","versionType":"git"},{"version":"4.4.255","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.255","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.158","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.172","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.1","status":"affected","lessThan":"5.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/futex/pi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/futex/pi.c"]}],"references":["https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85","https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da","https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293","https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d","https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23","https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"weaknesses":[],"ingestedAt":"2026-10-29T20:11:40.391Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/31xxx/CVE-2026-31555.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31555","state":"PUBLISHED","datePublished":"2026-04-24T14:35:39.211Z","dateUpdated":"2026-10-15T01:17:00.034Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-03-09T15:48:24.115Z"},"containers":{"cna":{"title":"futex: Clear stale exiting pointer in futex_lock_pi() retry path","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Clear stale exiting pointer in futex_lock_pi() retry path\n\nFuzzying/stressing futexes triggered:\n\n    WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524\n\nWhen futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY\nand stores a refcounted task pointer in 'exiting'.\n\nAfter wait_for_owner_exiting() consumes that reference, the local pointer\nis never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a\ndifferent error, the bogus pointer is passed to wait_for_owner_exiting().\n\n  CPU0\t\t\t     CPU1\t\t       CPU2\n  futex_lock_pi(uaddr)\n  // acquires the PI futex\n  exit()\n    futex_cleanup_begin()\n      futex_state = EXITING;\n\t\t\t     futex_lock_pi(uaddr)\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t attach_to_pi_owner()\n\t\t\t\t   // observes EXITING\n\t\t\t\t   *exiting = owner;  // takes ref\n\t\t\t\t   return -EBUSY\n\t\t\t       wait_for_owner_exiting(-EBUSY, owner)\n\t\t\t\t put_task_struct();   // drops ref\n\t\t\t       // exiting still points to owner\n\t\t\t       goto retry;\n\t\t\t       futex_lock_pi_atomic()\n\t\t\t\t lock_pi_update_atomic()\n\t\t\t\t   cmpxchg(uaddr)\n\t\t\t\t\t*uaddr ^= WAITERS // whatever\n\t\t\t\t   // value changed\n\t\t\t\t return -EAGAIN;\n\t\t\t       wait_for_owner_exiting(-EAGAIN, exiting) // stale\n\t\t\t\t WARN_ON_ONCE(exiting)\n\nFix this by resetting upon retry, essentially aligning it with requeue_pi."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"e7824ec168d2ac883a213cd1f4d6cc0816002a85","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"5e8e06bf8909e79b4acd950cf578cfc2f10bbefa","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"de7c0c04ad868f2cee6671b11c0a6d20421af1da","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"7475dfad10a05a5bfadebf5f2499bd61b19ed293","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"92e47ad03e03dbb5515bdf06444bf6b1e147310d","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"71112e62807d1925dc3ae6188b11f8cfc85aec23","versionType":"git"},{"version":"3ef240eaff36b8119ac9e2ea17cbf41179c930ba","status":"affected","lessThan":"210d36d892de5195e6766c45519dfb1e65f3eb83","versionType":"git"},{"version":"f2a9957e5c08b1b1caacd18a3dc4c0a1bdb7b463","status":"affected","versionType":"git"},{"version":"cf16e42709aa86aa3e37f3acc3d13d5715d90096","status":"affected","versionType":"git"},{"version":"61fa9f167caaa73d0a7c88f498eceeb12c6fa3db","status":"affected","versionType":"git"},{"version":"7874eee0130adf9bee28e8720bb5dd051089def3","status":"affected","versionType":"git"},{"version":"fc3b55ef2c840bb2746b2d8121a0788de84f7fac","status":"affected","versionType":"git"},{"version":"4.4.255","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.255","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.158","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.172","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.1","status":"affected","lessThan":"5.5","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/futex/pi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.5","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.253","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.203","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.80","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.21","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"6.19.11","status":"unaffected","lessThanOrEqual":"6.19.*","versionType":"semver"},{"version":"7.0","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/futex/pi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa"},{"url":"https://git.kernel.org/stable/c/e7824ec168d2ac883a213cd1f4d6cc0816002a85"},{"url":"https://git.kernel.org/stable/c/5e8e06bf8909e79b4acd950cf578cfc2f10bbefa"},{"url":"https://git.kernel.org/stable/c/de7c0c04ad868f2cee6671b11c0a6d20421af1da"},{"url":"https://git.kernel.org/stable/c/7475dfad10a05a5bfadebf5f2499bd61b19ed293"},{"url":"https://git.kernel.org/stable/c/92e47ad03e03dbb5515bdf06444bf6b1e147310d"},{"url":"https://git.kernel.org/stable/c/71112e62807d1925dc3ae6188b11f8cfc85aec23"},{"url":"https://git.kernel.org/stable/c/210d36d892de5195e6766c45519dfb1e65f3eb83"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-05-23T16:05:19.706Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.10.253"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"5.15.203"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.12.80"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.18.21"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"6.19.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.5","versionEndExcluding":"7.0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.255"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.255"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.158"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.172"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.5","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:17:00.034Z"},"x_adpType":"supplier"}]}}}