GHSA-7PM4-4MCQ-P2R3
Vulnerability from github – Published: 2026-09-04 18:31 – Updated: 2026-09-04 18:31In the Linux kernel, the following vulnerability has been resolved:
futex/pi: Plug private futex exec() race
The check for private futexes whether the waiter's mm, which is stored in the futex_key and copied into the pi_state, is the same as the owner's mm is not sufficient for exec(). exec() has a gap where the mm check fails to give the correct answer:
exec() ... exec_release_mm() futex_exec_release() tsk::futex::exit_state = EXITING; cleanup_robust_list(); 1) tsk::futex::exit_state = OK; ... old_mm = tsk::mm; 2) tsk::mm = ->mm;
Between #1 and #2 the check for the mm is wrong as that mm is about to be swapped out and eventually freed.
Plug this gap by:
1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in futex_exec_release()
2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after the mm has been switched.
From a futex point of view the task is dead after it finished the robust list cleanup up to the point where it sets the state to OK again.
{
"affected": [],
"aliases": [
"CVE-2026-80777"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-04T16:18:03Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter\u0027s mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner\u0027s mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n exec()\n ...\n exec_release_mm()\n futex_exec_release()\n tsk::futex::exit_state = EXITING;\n cleanup_robust_list();\n1) tsk::futex::exit_state = OK;\n ...\n old_mm = tsk::mm;\n2) tsk::mm = -\u003emm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n 1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n futex_exec_release()\n\n 2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again.",
"id": "GHSA-7pm4-4mcq-p2r3",
"modified": "2026-09-04T18:31:25Z",
"published": "2026-09-04T18:31:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80777"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.