{"id":"CVE-2026-99169","kind":"vulnerability","aliases":["CVE-2026-99169"],"related":[],"title":"Linux kernel: futex wakeups can reach the wrong process memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nfutex: Fix mm reuse handling for FUT_OFF_MMSHARED\n\nA FUT_OFF_MMSHARED futex is a shared futex that refers to an MM.\nIt is possible for a process to wait on a shared futex with a different MM\nbecause a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED\nfutex by another process.\nThis can cause FUT_OFF_MMSHARED waiters on a freed MM to consume\nwakeups intended for a newly allocated MM at the same address.\n\nFix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID.\nLeave private futexes as before to avoid influencing the performance of the\nhotpath.\n\n(Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by\nsetting clear_child_tid such that it points into anonymous memory, which\ncauses mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)","summary":"A shared futex can be requeued onto a memory map that has been freed, so waiters on a freed mm consume wakeups meant for a newly allocated mm at the same address. The fix keys shared futexes by a unique 64-bit per-mm ID instead of the address.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","multi-threaded","runtime"],"not_affected_if":[],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","triaged_at":"2026-10-28T11:35:37+00:00","updated_at":"2026-10-28T11:35:37+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:35:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"Linux kernel: futex wakeups can reach the wrong process memory","impact":"low","summary":"A shared futex can be requeued onto a memory map that has been freed, so waiters on a freed mm consume wakeups meant for a newly allocated mm at the same address. The fix keys shared futexes by a unique 64-bit per-mm ID instead of the address.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","multi-threaded"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown; wakeups may be consumed by the wrong process","analyst_note":"Check the kernel.org stable commit and NVD affected version ranges for this futex fix; the sources here give no severity or version list.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Systems running a Linux kernel that includes the futex mm-reuse change; the sources do not list affected kernel versions. Multi-threaded processes that set clear_child_tid into anonymous memory use this path implicitly. Private futexes are not changed by the fix.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000575,"input_tokens":3567,"output_tokens":437,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99169':13A,16A '64':63B,174C 'address':54B,72B,163C 'alloc':49B,158C 'anonym':213C 'anoth':138C 'avoid':186C 'bit':64B,175C 'caus':142C,216C 'child':206C 'clear':205C 'consum':43B,152C 'cve':11A,14A 'differ':120C 'fix':56B,84C,164C 'follow':78C 'freed':36B,41B,149C 'fut':89C,93C,124C,133C,143C,168C,200C 'futex':3A,25B,59B,83C,96C,100C,117C,136C,182C,227C 'handl':87C 'hotpath':192C 'id':68B,179C 'implicit':198C 'influenc':187C 'inod':126C 'instead':69B 'intend':154C 'kernel':2A,17B,76C 'key':57B,167C 'leav':180C 'linux':1A,18B,75C 'map':32B 'meant':45B 'memori':10A,31B,214C 'mm':42B,50B,67B,85C,105C,121C,150C,159C,178C,217C,224C 'mmshare':91C,95C,135C,145C,170C,202C 'multi':20B,194C,222C 'multi-thread':19B,193C,221C 'newli':48B,157C 'onto':29B,131C 'per':66B,177C 'per-mm':65B,176C 'perform':189C,226C 'point':211C 'possibl':108C 'privat':181C 'process':9A,111C,139C,196C 'reach':6A 'refer':102C 'releas':218C 'requeu':28B,130C 'resolv':82C 'reus':86C 'runtim':22B 'set':204C 'share':24B,58B,99C,116C 'thread':21B,195C,223C 'tid':207C 'typic':197C 'uniqu':62B,173C 'use':171C,199C 'vulner':79C 'wait':113C 'waiter':38B,127C,146C 'wake':228C 'wakeup':4A,44B,153C 'wrong':8A","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel that includes the futex mm-reuse change; the sources do not list affected kernel versions. Multi-threaded processes that set clear_child_tid into anonymous memory use this path implicitly. Private futexes are not changed by the fix.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99169","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99169","severity":null,"published_at":"2026-10-28T11:17:37+00:00","modified_at":"2026-10-28T11:17:37+00:00","first_seen_at":"2026-10-28T11:32:36+00:00","fetched_at":"2026-10-28T11:32:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}