Linux Kernel: FUT_OFF_MMSHARED Futex MM Reuse Handling Vulnerability
CVE-2026-99169 Published on October 28, 2026
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
In the Linux kernel, the following vulnerability has been resolved:
futex: Fix mm reuse handling for FUT_OFF_MMSHARED
A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM.
It is possible for a process to wait on a shared futex with a different MM
because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED
futex by another process.
This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume
wakeups intended for a newly allocated MM at the same address.
Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID.
Leave private futexes as before to avoid influencing the performance of the
hotpath.
(Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by
setting clear_child_tid such that it points into anonymous memory, which
causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)
Products Associated with CVE-2026-99169
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 222993395ed38f3751287f4bd82ef46b3eb3a66d and below c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81 is affected.
- Version 222993395ed38f3751287f4bd82ef46b3eb3a66d and below 2855ddc6844f527e375e78afb55ec2a5182f23b3 is affected.
- Version 222993395ed38f3751287f4bd82ef46b3eb3a66d and below 3267512ad1c2cc0c7768c5b014dc2cceb398a801 is affected.
- Version 5.7 is affected.
- Before 5.7 is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.