CVE-2026-43499: Linux Kernel rtmutex Flaw Enables Local Privilege Escalation — Patch Now

Vulnerability Summary

CVE-2026-43499 is a high-severity (CVSS 7.8) flaw in the Linux kernel's real-time mutex (rtmutex) implementation. The bug lives in how the kernel dequeues a waiter from a priority-inheritance (PI) lock, and it can lead to memory corruption and local privilege escalation.

| Detail | Information | |--------|-------------| | CVE ID | CVE-2026-43499 | | CVSS 3.0 Score | 7.8 (High) | | Ubuntu Priority | High | | Attack Vector | Local | | Affected Component | Linux kernel rtmutex / PI-futex subsystem | | Affected Package | linux (and variants: linux-aws, linux-azure, linux-gcp, linux-oracle, linux-raspi, linux-realtime, linux-riscv, …) | | Impact | Memory corruption, potential local privilege escalation | | Fix | Kernel package update + reboot |

What Goes Wrong

The vulnerability is in the kernel's remove_waiter() path. When a task stops waiting on a real-time mutex, the kernel must remove that task's waiter from the lock's red-black tree of waiters and unwind any priority-inheritance boosting.

The bug: remove_waiter() operates on current (the task running the code) for the dequeue operation when it should operate on the waiter's own task. In most paths these are the same, but on the paths where they differ, three things break:

1. Unlocked red-black tree dequeue — the waiter is removed from the tree without the correct lock held, risking tree corruption under contention.
2. Priority-inheritance state left dangling — the waiter task's PI state isn't cleared, leaving a dangling pointer that can be dereferenced later.
3. Priority chain adjusted on the wrong task — the PI chain walk boosts/deboosts the incorrect task, corrupting scheduling state.

             Task A waits on rtmutex L
                       │
             remove_waiter() called
                       │
        ┌──────────────┴───────────────┐
        │ operates on `current`         │  ← BUG
        │ instead of the waiter's task  │
        └──────────────┬───────────────┘
                        ▼
     RB-tree dequeue without proper lock
     PI state not cleared → dangling pointer
     PI chain walk on wrong task

Because PI-futexes are reachable from unprivileged user space (glibc uses them for PTHREAD_PRIO_INHERIT mutexes), a local attacker can drive the vulnerable path deliberately. Depending on the exact race won, the result ranges from a kernel crash (DoS) to controlled memory corruption suitable for local privilege escalation.

Related: Linux Server Hardening Guide — reduce the blast radius of local vulnerabilities like this one.

Am I Affected?

This is a local vulnerability — an attacker needs the ability to run code on the machine (a shell, a container, a CI runner, a compromised service account). It is most dangerous on:

• Multi-tenant hosts and shared build/CI servers
• Container hosts — containers share the host kernel, so a container escape primitive matters here
• Real-time / low-latency systems using linux-realtime where PI mutexes are heavily exercised

Check your running kernel:

Affected & Fixed Versions

Fixed package versions for Ubuntu 26.04 LTS (Resolute):

| Package | Fixed Version | |---------|---------------| | linux | 7.0.0-27.27 | | linux-aws | 7.0.0-1008.8 | | linux-gcp | 7.0.0-1007.7 | | linux-ibm | 7.0.0-1009.9 | | linux-nvidia | 7.0.0-1013.13 | | linux-oracle | 7.0.0-1007.7 | | linux-raspi | 7.0.0-1014.14 | | linux-realtime | 7.0.0-27.27.1 | | linux-riscv | 7.0.0-27.27.1 |

At time of writing, several older Ubuntu releases (22.04 LTS, 20.04 LTS, 18.04 ESM) were still marked work in progress — check the official Ubuntu CVE page for the current status of your release before assuming a fix is available.

How to Patch

Ubuntu / Debian

Verify after reboot:

Livepatch (avoid the reboot)

On Ubuntu Pro systems, Canonical Livepatch may ship this fix without a reboot:

If a livepatch is applied, canonical-livepatch status will list the CVE as fixed. Note that for a bug of this kind a full reboot onto the patched kernel is still the definitive fix.

Fleet-wide

For multiple hosts, roll this out via your existing config management (Ansible apt module, unattended-upgrades with reboots enabled, or your image pipeline) and confirm each host reboots onto the fixed uname -r.

Related: OpenVAS Vulnerability Assessment & Scanning — scan your fleet to confirm which hosts still run the vulnerable kernel.

Interim Mitigations (If You Can't Patch Immediately)

There is no clean toggle to disable PI-futexes without breaking applications, so mitigation is about limiting who can reach the bug:

• Restrict local access — this is a local-only flaw; tightening SSH access, removing unnecessary shell accounts, and hardening CI runners all reduce exposure.
• Harden container isolation — apply restrictive seccomp/AppArmor profiles and avoid --privileged containers on unpatched hosts.
• Enable automatic reboots for security updates on non-critical hosts via unattended-upgrades.

None of these are a substitute for the kernel update — treat them as stopgaps only.

Bottom Line

CVE-2026-43499 is a classic "wrong task operated on" kernel bug: low glamour, high impact. It's local, but on shared and containerized infrastructure "local" is a low bar. The fix is straightforward — update the kernel package and reboot — so patch it, verify uname -r, and move on.

Related: Network Monitoring Best Practices — catch unpatched hosts before an attacker does.