CVE-2026-53163
locking/rtmutex: Skip remove_waiter() when waiter is not enqueued
Description
In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex().
INFO
Published Date :
June 25, 2026, 9:16 a.m.
Last Modified :
July 7, 2026, 6:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Update the Linux kernel to the latest stable version.
- Ensure the kernel patch for rtmutex is applied.
- Reboot systems after kernel updates.
Public PoC/Exploit Available at Github
CVE-2026-53163 has a 4 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53163.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53163 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53163
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Sanitized public CI mirror for Lenovo TB322FC Android 15 GKI 6.6.111 ReSukiSU build
C Python Shell HTML JavaScript SCSS Makefile C++ Assembly
KernelSU/MKSU/SukiSU/ReSukiSU/KernelSU-Next + SUSFS GKI KERNEL
Shell JavaScript C++ Python C Assembly Makefile HTML SCSS
使用 Github Actions 为 一加 5.10 ~ 6.6 系 编译 KernelSU / SukiSU Ultra / ReSukiSU / KernelSU Next + SUSFS 的 GKI 内核
Python Shell C
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53163 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53163 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 07, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-476 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.18.27 up to (excluding) 6.18.36 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 7.0.4 up to (excluding) 7.0.13 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.1.175 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.12.86 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.6.140 up to (excluding) 6.6.144 Added Reference Type kernel.org: https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4afda3a1da02129568a3a2f1898aa13e6763bcba Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/55363fa0a04524d11efeaadee734d2db1756ed27 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5799f9bd7fee40370b93ab1ddf001cdc7017c14d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 04, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/4afda3a1da02129568a3a2f1898aa13e6763bcba Added Reference https://git.kernel.org/stable/c/5799f9bd7fee40370b93ab1ddf001cdc7017c14d Added Reference https://git.kernel.org/stable/c/6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48 Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3fb7394a837740770f0d6b4b30567e60786a63f2', 'lessThan': 'a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53', 'versionType': 'git'}, {'status': 'affected', 'version': '88614876370aac8ad1050ad785a4c095ba17ac11', 'lessThan': '55363fa0a04524d11efeaadee734d2db1756ed27', 'versionType': 'git'}, {'status': 'affected', 'version': '3bfdc63936dd4773109b7b8c280c0f3b5ae7d349', 'lessThan': '40a25d59e85b3c8709ac2424d44f65610467871e', 'versionType': 'git'}, {'status': 'affected', 'version': 'd8cce4773c2b23d819baf5abedc62f7b430e8745', 'versionType': 'git'}, {'status': 'affected', 'version': '8a1fc8d698ac5e5916e3082a0f74450d71f9611f', 'versionType': 'git'}, {'status': 'affected', 'version': '6d52dfcb2a5db86e346cf51f8fcf2071b8085166', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.140', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.86', 'lessThan': '6.13', 'versionType': 'semver'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.18.27', 'lessThan': '6.18.36', 'versionType': 'semver'}, {'status': 'affected', 'version': '7.0.4', 'lessThan': '7.0.13', 'versionType': 'semver'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd8cce4773c2b23d819baf5abedc62f7b430e8745', 'lessThan': '4afda3a1da02129568a3a2f1898aa13e6763bcba', 'versionType': 'git'}, {'status': 'affected', 'version': '8a1fc8d698ac5e5916e3082a0f74450d71f9611f', 'lessThan': '6707d7e0b71748cb3cd95bad81dae5fe1b3c8f48', 'versionType': 'git'}, {'status': 'affected', 'version': '6d52dfcb2a5db86e346cf51f8fcf2071b8085166', 'lessThan': '5799f9bd7fee40370b93ab1ddf001cdc7017c14d', 'versionType': 'git'}, {'status': 'affected', 'version': '3fb7394a837740770f0d6b4b30567e60786a63f2', 'lessThan': 'a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53', 'versionType': 'git'}, {'status': 'affected', 'version': '88614876370aac8ad1050ad785a4c095ba17ac11', 'lessThan': '55363fa0a04524d11efeaadee734d2db1756ed27', 'versionType': 'git'}, {'status': 'affected', 'version': '3bfdc63936dd4773109b7b8c280c0f3b5ae7d349', 'lessThan': '40a25d59e85b3c8709ac2424d44f65610467871e', 'versionType': 'git'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.1.175', 'lessThan': '6.1.177', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.140', 'lessThan': '6.6.144', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.86', 'lessThan': '6.12.95', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.18.27', 'lessThan': '6.18.36', 'versionType': 'semver'}, {'status': 'affected', 'version': '7.0.4', 'lessThan': '7.0.13', 'versionType': 'semver'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}] -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3fb7394a837740770f0d6b4b30567e60786a63f2', 'lessThan': 'a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53', 'versionType': 'git'}, {'status': 'affected', 'version': '88614876370aac8ad1050ad785a4c095ba17ac11', 'lessThan': '55363fa0a04524d11efeaadee734d2db1756ed27', 'versionType': 'git'}, {'status': 'affected', 'version': '3bfdc63936dd4773109b7b8c280c0f3b5ae7d349', 'lessThan': '40a25d59e85b3c8709ac2424d44f65610467871e', 'versionType': 'git'}, {'status': 'affected', 'version': 'd8cce4773c2b23d819baf5abedc62f7b430e8745', 'versionType': 'git'}, {'status': 'affected', 'version': '8a1fc8d698ac5e5916e3082a0f74450d71f9611f', 'versionType': 'git'}, {'status': 'affected', 'version': '6d52dfcb2a5db86e346cf51f8fcf2071b8085166', 'versionType': 'git'}, {'status': 'affected', 'version': '6.1.175', 'lessThan': '6.2', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.140', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.12.86', 'lessThan': '6.13', 'versionType': 'semver'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '6.18.27', 'lessThan': '6.18.36', 'versionType': 'semver'}, {'status': 'affected', 'version': '7.0.4', 'lessThan': '7.0.13', 'versionType': 'semver'}], 'programFiles': ['kernel/locking/rtmutex.c', 'kernel/locking/rtmutex_api.c'], 'defaultStatus': 'unaffected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: locking/rtmutex: Skip remove_waiter() when waiter is not enqueued syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: KASAN: null-ptr-deref in range [0x0000000000000a88-0x0000000000000a8f] class_raw_spinlock_constructor remove_waiter+0x159/0x1200 kernel/locking/rtmutex.c:1561 rt_mutex_start_proxy_lock+0x103/0x120 futex_requeue+0x10e4/0x20d0 __x64_sys_futex+0x34f/0x4d0 task_blocks_on_rt_mutex() does not arm the waiter upon deadlock detection, leaving waiter->task nil, where 3bfdc63936dd ("rtmutex: Use waiter::task instead of current in remove_waiter()") made this fatal. Furthermore, rt_mutex_start_proxy_lock() should not be calling into remove_waiter() upon a successfully grabbing the rtmutex. 1a1fb985f2e2 ("futex: Handle early deadlock return correctly"), moved the remove_waiter() out of __rt_mutex_start_proxy_lock() (where 'ret' was only ever 0 or < 0) into the wrapper. Tighten this check to account for try_to_take_rt_mutex(). Added Reference https://git.kernel.org/stable/c/40a25d59e85b3c8709ac2424d44f65610467871e Added Reference https://git.kernel.org/stable/c/55363fa0a04524d11efeaadee734d2db1756ed27 Added Reference https://git.kernel.org/stable/c/a388e3dfaf9538a680de5ed43a8ebb5dd45b6e53