{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43499 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-43499 is a high-severity use after free vulnerability in Linux kernel, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-43499 and fix it if it is affected.\n\nWhat it is: CVE-2026-43499 is a high-severity use after free vulnerability in Linux kernel, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43499 exists.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-43499/ (Markdown: https://insights.sbomify.com/CVE-2026-43499/index.md)","id":"CVE-2026-43499","markdown":"https://insights.sbomify.com/CVE-2026-43499/index.md","name":"CVE-2026-43499","record":{"aliases":["AZL-87066","BELL-CVE-2026-43499","DEBIAN-CVE-2026-43499","GHSA-cqc6-9f34-295v","RHSA-2026:41920","ROOT-OS-DEBIAN-11-CVE-2026-43499","ROOT-OS-DEBIAN-12-CVE-2026-43499","ROOT-OS-UBUNTU-2204-CVE-2026-43499","ROOT-OS-UBUNTU-2404-CVE-2026-43499","UBUNTU-CVE-2026-43499"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"A use-after-free vulnerability in the Linux kernel's rtmutex subsystem allows attackers to execute arbitrary code or escalate privileges via futex requeue operations.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":7.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-416","name":"Use After Free"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrtmutex: Use waiter::task instead of current in remove_waiter()\n\nremove_waiter() is used by the slowlock paths, but it is also used for\nproxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from\nfutex_requeue().\n\nIn the latter case waiter::task is not current, but remove_waiter()\noperates on current for the dequeue operation. That results in several\nproblems:\n\n  1) the rbtree dequeue happens without waiter::task::pi_lock being held\n\n  2) the waiter task's pi_blocked_on state is not cleared, which leaves a\n     dangling pointer primed for UAF around.\n\n  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter\n     task\n\nUse waiter::task instead of current in all related operations in\nremove_waiter() to cure those problems.\n\n[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the\n  \tchangelog ]","ecosystems":["Red Hat:rhel_els:6"],"exploits":{"exploitdb":0,"first_seen":"2026-06-27","github_poc":179,"max_poc_stars":2416,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-07-29T05:04:25Z","kind":"github_poc","ref":"https://github.com/YuKongA/ghostlock-app","stars":2416,"title":"GhostLock One-Tap Execution App (CVE-2026-43499)"},{"date":"2026-07-17T14:24:08Z","kind":"github_poc","ref":"https://github.com/BuSung-dev/Root-My-Galaxy","stars":1511,"title":"KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499"},{"date":"2026-08-02T17:34:45Z","kind":"github_poc","ref":"https://github.com/alex193a/Root-My-Pixel","stars":477,"title":"Jailbreak supported Google Pixel phones with CVE-2026-43499"},{"date":"2026-07-12T16:05:24Z","kind":"github_poc","ref":"https://github.com/JoinChang/ghostlock-oneplus","stars":439,"title":"GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader"},{"date":"2026-08-14T10:51:50Z","kind":"github_poc","ref":"https://github.com/hmascs/KSuRoot","stars":270,"title":"KSuRoot 4.0.0 — 基于 CVE-2026-43499(GhostLock) 的一键 KernelSU 提权工具。多内核支持：6.1 / 6.6 / 6.12 三族各有专属基线，另有 50 档上游内核适配；多机型动态库内置：122 条厂商载荷（vivo/iQOO、小米、三星、Pixel 等）离线可用、按机型+内核+commit 三级匹配；新增「载荷构建」用本机 boot.img 解析偏移打出适配本机的载荷（通用 / vivo 专用）；免 ADB。Mod by hmascs"},{"date":"2026-07-12T10:15:03Z","kind":"github_poc","ref":"https://github.com/x-spy/CVE-2026-43499-popsicle","stars":257,"title":"CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k"},{"date":"2026-06-27T04:09:11Z","kind":"github_poc","ref":"https://github.com/MobiusM/CVE-2026-43499","stars":163,"title":"CVE-2026-43499 PoC"},{"date":"2026-07-14T14:21:27Z","kind":"github_poc","ref":"https://github.com/Linuxoid-cn/CVE-2026-43499-Poc-Analysis","stars":115,"title":"Vulnerability analysis and Proof of Concept (PoC) for CVE-2026-43499 affecting Xiaomi devices. For educational and research purposes only."}],"tier":"weaponised"},"has_fix":true,"headline":"rtmutex: Use waiter::task instead of current in remove_waiter()","id":"CVE-2026-43499","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"use_after_free","year":"2026"},"n_packages":19,"n_references":8,"next":{"headline":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","id":"CVE-2026-43500"},"packages":[{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel","purl":"pkg:rpm/redhat/kernel","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-abi-whitelists","purl":"pkg:rpm/redhat/kernel-abi-whitelists","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug","purl":"pkg:rpm/redhat/kernel-debug","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-debuginfo","purl":"pkg:rpm/redhat/kernel-debug-debuginfo","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debug-devel","purl":"pkg:rpm/redhat/kernel-debug-devel","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo","purl":"pkg:rpm/redhat/kernel-debuginfo","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-i686","purl":"pkg:rpm/redhat/kernel-debuginfo-common-i686","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-s390x","purl":"pkg:rpm/redhat/kernel-debuginfo-common-s390x","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-debuginfo-common-x86_64","purl":"pkg:rpm/redhat/kernel-debuginfo-common-x86_64","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-devel","purl":"pkg:rpm/redhat/kernel-devel","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-doc","purl":"pkg:rpm/redhat/kernel-doc","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-firmware","purl":"pkg:rpm/redhat/kernel-firmware","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump","purl":"pkg:rpm/redhat/kernel-kdump","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump-debuginfo","purl":"pkg:rpm/redhat/kernel-kdump-debuginfo","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"kernel-kdump-devel","purl":"pkg:rpm/redhat/kernel-kdump-devel","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"perf","purl":"pkg:rpm/redhat/perf","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"perf-debuginfo","purl":"pkg:rpm/redhat/perf-debuginfo","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"python-perf","purl":"pkg:rpm/redhat/python-perf","source":"RHSA-2026:41920"},{"ecosystem":"Red Hat:rhel_els:6","fixed":["0:2.6.32-754.62.1.el6"],"introduced":["0"],"last_affected":[],"package":"python-perf-debuginfo","purl":"pkg:rpm/redhat/python-perf-debuginfo","source":"RHSA-2026:41920"}],"prev":{"headline":"accel/ivpu: Disallow re-exporting imported GEM objects","id":"CVE-2026-43498"},"products":["Linux"],"published":"2026-05-21","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"poc","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-15","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's rtmutex subsystem allows attackers to execute arbitrary code or escalate privileges via futex requeue operations.","url":"https://insights.sbomify.com/CVE-2026-43499/"}