{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80777","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-08-26T14:34:25.792Z","datePublished":"2026-09-04T15:12:49.215Z","dateUpdated":"2026-09-04T15:12:49.215Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-09-04T15:12:49.215Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Plug private futex exec() race\n\nThe check for private futexes whether the waiter's mm, which is stored in\nthe futex_key and copied into the pi_state, is the same as the owner's mm\nis not sufficient for exec(). exec() has a gap where the mm check fails to\ngive the correct answer:\n\n  exec()\n  ...\n    exec_release_mm()\n      futex_exec_release()\n        tsk::futex::exit_state = EXITING;\n        cleanup_robust_list();\n1)      tsk::futex::exit_state = OK;\n    ...\n    old_mm = tsk::mm;\n2)  tsk::mm = ->mm;\n\nBetween #1 and #2 the check for the mm is wrong as that mm is about to be\nswapped out and eventually freed.\n\nPlug this gap by:\n\n  1) Setting tsk::futex::exit_state to FUTEX_STATE_DEAD in\n     futex_exec_release()\n\n  2) Setting tsk::futex::exit_state to FUTEX_STATE_OK after\n     the mm has been switched.\n\nFrom a futex point of view the task is dead after it finished the robust\nlist cleanup up to the point where it sets the state to OK again."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"],"versions":[{"version":"80367ad01d93ac781b0e1df246edaf006928002f","lessThan":"fdf538b2e69653ff740e84042245018e5680cd7b","status":"affected","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","lessThan":"0478bc6bf197629fea0331d65b39eeea043c6cf0","status":"affected","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","lessThan":"d7944cee62ec6cca1c90780a766960a57d3b4bb8","status":"affected","versionType":"git"},{"version":"80367ad01d93ac781b0e1df246edaf006928002f","lessThan":"c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/exec.c","include/linux/futex.h","kernel/futex/core.c","kernel/futex/pi.c"],"versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","status":"unaffected","versionType":"semver"},{"version":"6.18.47","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.1.11","lessThanOrEqual":"7.1.*","status":"unaffected","versionType":"semver"},{"version":"7.2.1","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.47"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.3-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/fdf538b2e69653ff740e84042245018e5680cd7b"},{"url":"https://git.kernel.org/stable/c/0478bc6bf197629fea0331d65b39eeea043c6cf0"},{"url":"https://git.kernel.org/stable/c/d7944cee62ec6cca1c90780a766960a57d3b4bb8"},{"url":"https://git.kernel.org/stable/c/c5f0bc9fd1cec4a00400cc727fcde03e0fde17cc"}],"title":"futex/pi: Plug private futex exec() race","x_generator":{"engine":"bippy-1.2.0"}}}}