{"id":"CVE-2026-80777","state":"PUBLISHED","title":"futex/pi: Plug private futex exec() race","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner's mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n  exec()\n  ...\n    exec_release_mm()\n      futex_exec_release()\n        tsk::futex::exit_state = EXITING;\n        cleanup_robust_list();\n1)      tsk::futex::exit_state = OK;\n    ...\n    old_mm = tsk::mm;\n2)  tsk::mm = ->mm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n  1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n     futex_exec_release()\n\n  2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n     the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again.","publishedAt":"2026-09-04T15:12:49.215Z","updatedAt":"2026-10-19T08:43:32.707Z","severity":null,"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"fdf538b2e69653ff740e84042245018e5680cd7b","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"0478bc6bf197629fea0331d65b39eeea043c6cf0","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"d7944cee62ec6cca1c90780a766960a57d3b4bb8","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.11","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2.1","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"]}],"references":["https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b","https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0","https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8","https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:07.220Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80777.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80777","state":"PUBLISHED","datePublished":"2026-09-04T15:12:49.215Z","dateUpdated":"2026-10-19T08:43:32.707Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.792Z"},"containers":{"cna":{"title":"futex/pi: Plug private futex exec() race","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner's mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n  exec()\n  ...\n    exec_release_mm()\n      futex_exec_release()\n        tsk::futex::exit_state = EXITING;\n        cleanup_robust_list();\n1)      tsk::futex::exit_state = OK;\n    ...\n    old_mm = tsk::mm;\n2)  tsk::mm = ->mm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n  1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n     futex_exec_release()\n\n  2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n     the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"fdf538b2e69653ff740e84042245018e5680cd7b","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"0478bc6bf197629fea0331d65b39eeea043c6cf0","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"d7944cee62ec6cca1c90780a766960a57d3b4bb8","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","status":"affected","lessThan":"c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.47","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.11","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2.1","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b"},{"url":"https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0"},{"url":"https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8"},{"url":"https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T08:43:32.707Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}