# CVE-2026-43499: rtmutex: Use waiter::task instead of current in remove_waiter()

> A use-after-free vulnerability in the Linux kernel's rtmutex subsystem allows attackers to execute arbitrary code or escalate privileges via futex requeue operations.

- **Severity:** High 7.8 (`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 21 May 2026
- **Updated:** 15 Oct 2026
- **Also known as:** AZL-87066, BELL-CVE-2026-43499, DEBIAN-CVE-2026-43499, GHSA-cqc6-9f34-295v, RHSA-2026:41920, ROOT-OS-DEBIAN-11-CVE-2026-43499, ROOT-OS-DEBIAN-12-CVE-2026-43499, ROOT-OS-UBUNTU-2204-CVE-2026-43499, ROOT-OS-UBUNTU-2404-CVE-2026-43499, UBUNTU-CVE-2026-43499

## What is CVE-2026-43499?

CVE-2026-43499 is a high-severity use after free vulnerability in Linux kernel, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

rtmutex: Use waiter::task instead of current in remove_waiter()

remove_waiter() is used by the slowlock paths, but it is also used for
proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from
futex_requeue().

In the latter case waiter::task is not current, but remove_waiter()
operates on current for the dequeue operation. That results in several
problems:

  1) the rbtree dequeue happens without waiter::task::pi_lock being held

  2) the waiter task's pi_blocked_on state is not cleared, which leaves a
     dangling pointer primed for UAF around.

  3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter
     task

Use waiter::task instead of current in all related operations in
remove_waiter() to cure those problems.

[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the
  	changelog ]

Weakness: CWE-416 (Use After Free)

## Which versions are affected by CVE-2026-43499?

It affects 1 product.


| Package | Ecosystem | Affected | Fixed in |
| --- | --- | --- | --- |
| `kernel` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-abi-whitelists` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debug` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debug-debuginfo` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debug-devel` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debuginfo` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debuginfo-common-i686` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debuginfo-common-s390x` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-debuginfo-common-x86_64` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-devel` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-doc` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-firmware` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-kdump` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-kdump-debuginfo` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `kernel-kdump-devel` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `perf` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `perf-debuginfo` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `python-perf` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |
| `python-perf-debuginfo` | Red Hat:rhel_els:6 | All versions | 0:2.6.32-754.62.1.el6 |

Products: Linux kernel.

## How do I fix CVE-2026-43499?

Apply the vendor's patch.

## Is CVE-2026-43499 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43499 exists.

Public exploit code:

- GhostLock One-Tap Execution App (CVE-2026-43499) (github_poc): https://github.com/YuKongA/ghostlock-app
- KSU installer for supported Samsung Galaxy firmware with CVE-2026-43499 (github_poc): https://github.com/BuSung-dev/Root-My-Galaxy
- Jailbreak supported Google Pixel phones with CVE-2026-43499 (github_poc): https://github.com/alex193a/Root-My-Pixel
- GhostLock (CVE-2026-43499) kernel exploit for Android devices with locked bootloader (github_poc): https://github.com/JoinChang/ghostlock-oneplus
- KSuRoot 4.0.0 — 基于 CVE-2026-43499(GhostLock) 的一键 KernelSU 提权工具。多内核支持：6.1 / 6.6 / 6.12 三族各有专属基线，另有 50 档上游内核适配；多机型动态库内置：122 条厂商载荷（vivo/iQOO、小米、三星、Pixel 等）离线可用、按机型+内核+commit 三级匹配；新增「载荷构建」用本机 boot.img 解析偏移打出适配本机的载荷（通用 / vivo 专用）；免 ADB。Mod by hmascs (github_poc): https://github.com/hmascs/KSuRoot
- CVE-2026-43499 Implementation for 6.12.23-android16-5-g75e9b1c7ae7c-abogki463945075-4k (github_poc): https://github.com/x-spy/CVE-2026-43499-popsicle

## Other vulnerabilities in Linux kernel

- [CVE-2026-53266](https://insights.sbomify.com/CVE-2026-53266/): Linux Kernel Out-of-Bounds Write (high 8.8, exploited in the wild)
- [CVE-2013-6282](https://insights.sbomify.com/CVE-2013-6282/): Linux Kernel Improper Input Validation (high 8.8, exploited in the wild)
- [CVE-2022-0185](https://insights.sbomify.com/CVE-2022-0185/): Linux Kernel Heap-Based Buffer Overflow (high 8.4, exploited in the wild)
- [CVE-2013-2094](https://insights.sbomify.com/CVE-2013-2094/): Linux Kernel Privilege Escalation (high 8.4, exploited in the wild)
- [CVE-2026-53362](https://insights.sbomify.com/CVE-2026-53362/): Linux Kernel Unspecified (high 7.8, exploited in the wild)

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-43499 and fix it if it is affected.

What it is: CVE-2026-43499 is a high-severity use after free vulnerability in Linux kernel, published on 21 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43499 exists.

Affected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-43499/ (Markdown: https://insights.sbomify.com/CVE-2026-43499/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-43499
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-43499
- OSV: https://osv.dev/vulnerability/CVE-2026-43499

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-43499/
Summaries are generated and may contain mistakes; the official description above is the record.