CVE-2026-80778

In the Linux kernel, the following vulnerability has been resolved:

futex/pi: Reject cross-mm private futex owners

A private futex key borrows the waiter's mm without taking an mm_users

reference. Nevertheless, attach_to_pi_owner() currently accepts an owner

from a different address space and copies the private key into the owner's

PI state.

When that owner exits, exit_pi_state_list() uses the saved key to find the

hash bucket and acquires a reference to the waiter's private hash. If the

last user of the waiter's mm exits concurrently, futex_hash_free() frees

the hash while the owner still uses its bucket and reference.

Prevent this by validating in attach_to_pi_owner() that, for private

futexes, the owner mm and waiter mm are the same. Perform the check with

the owner's pi_lock held and after validating owner::futex::state to

serialize against a concurrent PI-state exit cleanup.

[ tglx: Amended comment ]