CVE-2026-80777

What it actually does

Race condition in private futex pi_state mm validation during exec() allows a window where the waiter's mm check returns incorrect results between robust list cleanup and mm swap, enabling use of a soon-to-be-freed mm_struct.

Why it matters to the business

Kernel instability or potential memory corruption in multi-threaded applications using robust futexes under exec(), increasing crash rates and operational risk in Linux environments until patched.

How an attack unfolds

An attacker triggers a private futex operation on a robust list in one thread while concurrently calling exec() in another; the brief window after exit_state is reset but before mm is updated allows the mm mismatch check to pass incorrectly, leading to pi_state referencing a freed mm.

How to fix it

Update the Linux kernel to a version containing the futex_exec_release state machine changes that set FUTEX_STATE_DEAD before mm swap and FUTEX_STATE_OK only after; rebuild and deploy the fixed kernel across all affected systems.

How to confirm the fix worked

Confirm kernel source contains the FUTEX_STATE_DEAD assignment in futex_exec_release and the post-mm-switch FUTEX_STATE_OK reset; test by exercising robust private futex exec sequences under concurrency and verify no mm mismatch warnings or crashes occur.

Typical attack path

1. Create threads sharing a private robust futex
2. Initiate exec() in the owner thread to enter the cleanup window
3. Perform futex wait or lock operations from the waiter thread during the mm-swap gap
4. Trigger use of the stale pi_state after mm is freed

How to detect it

Search kernel logs and crash dumps for futex-related warnings around exec or mm release; examine robust list cleanup paths for unexpected state transitions; no public exploit artifacts known.

What your security team should do

• Prioritize kernel updates on systems running multi-threaded applications with robust futex usage
• Monitor for new stable kernel releases containing this fix and schedule rolling reboots
• Review application usage of private robust lists to reduce exposure until patches are applied