dnlid/cve-2026-43499CVE-2026-43499: Linux kernel futex PI use-after-free research package
remove_waiter() in kernel/locking/rtmutex.c is used by the slowlock paths but also for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue().
In the proxy-lock case waiter::task is not current, but remove_waiter() incorrectly operates on current. This causes three problems:
waiter::task::pi_lock being held.pi_blocked_on is not cleared, leaving a dangling pointer primed for use-after-free.rt_mutex_adjust_prio_chain() operates on the wrong task.CWE-416 (Use After Free). CVSS 3.1: 7.8 HIGH (Local, Low complexity, Low privileges required).
Affected: Linux 2.6.39 through 6.18.x; patched in 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4.
Non-escalating validation harness for the authorized test device only.
Reproducible package: test_package/ (build, hashes, ADB steps, disclosure).
Prerequisites: Android NDK r27+, adb. On Windows: .\build.ps1.
.\build.ps1
adb push build/ghostlock_validate /data/local/tmp/ghostlock_validate
adb shell chmod 755 /data/local/tmp/ghostlock_validate
# Safe default (recommended)
adb shell /data/local/tmp/ghostlock_validate --dry-run --retries 3
# Optional crash probe (may panic) — not for privilege escalation
# adb shell /data/local/tmp/ghostlock_validate --probe --retries 1
--dry-run success: EDEADLK=1 + DRY_RUN_STOP_BEFORE_CORRUPTION=1.
Proof package (what is / is not demonstrated on this phone): evidence/PROOF.md
Vendor package (dry-run transcripts + disclosure bundle): evidence/vendor_package_20260726/
Vendor disclosure: test_package/docs/VENDOR_DISCLOSURE.md.
Other-device public repos (reference only, not applicable to amber): evidence/OTHER_DEVICE_REPOS.md
No credential / SELinux / CFI / root stages are implemented.
Reported by:
Fix authored by: Keenan Dong
Fix committed by: Thomas Gleixner
Commit: 3bfdc63 — rtmutex: Use waiter::task instead of current in remove_waiter()