CVE-2026-31555

In the Linux kernel, the following vulnerability has been resolved:

futex: Clear stale exiting pointer in futex_lock_pi() retry path

Fuzzying/stressing futexes triggered:

WARNING: kernel/futex/core.c:825 at wait_for_owner_exiting+0x7a/0x80, CPU#11: futex_lock_pi_s/524

When futex_lock_pi_atomic() sees the owner is exiting, it returns -EBUSY

and stores a refcounted task pointer in 'exiting'.

After wait_for_owner_exiting() consumes that reference, the local pointer

is never reset to nil. Upon a retry, if futex_lock_pi_atomic() returns a

different error, the bogus pointer is passed to wait_for_owner_exiting().

CPU0 CPU1 CPU2

futex_lock_pi(uaddr)

// acquires the PI futex

exit()

futex_cleanup_begin()

futex_state = EXITING;

futex_lock_pi(uaddr)

futex_lock_pi_atomic()

attach_to_pi_owner()

// observes EXITING

*exiting = owner; // takes ref

return -EBUSY

wait_for_owner_exiting(-EBUSY, owner)

put_task_struct(); // drops ref

// exiting still points to owner

goto retry;

futex_lock_pi_atomic()

lock_pi_update_atomic()

cmpxchg(uaddr)

*uaddr ^= WAITERS // whatever

// value changed

return -EAGAIN;

wait_for_owner_exiting(-EAGAIN, exiting) // stale

WARN_ON_ONCE(exiting)

Fix this by resetting upon retry, essentially aligning it with requeue_pi.