CVE-2026-80776
Received Received - Intake

Race in futex_pivot_pending() in Linux Kernel

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: futex: Fix race in futex_pivot_pending() during private hash resize A task performing a custom private hash resize can remain blocked in uninterruptible sleep indefinitely. The hung-task detector reports: INFO: task futex-resizer:314 blocked for more than 10 seconds. task:futex-resizer state:D stack:14824 pid:314 tgid:312 ppid:311 Call Trace: __schedule+0x521/0xf30 schedule+0x22/0xa0 futex_hash_allocate+0x3db/0x490 __do_sys_prctl+0x6f5/0xbd0 do_syscall_64+0xf9/0x530 entry_SYSCALL_64_after_hwframe+0x77/0x7f Kernel panic - not syncing: hung_task: blocked tasks futex_pivot_pending() allows the resize request to continue when either no replacement hash is pending (hash_new == NULL) or the current hash reference count has reached zero. After the final-reference wake, another futex task can complete the pivot between the two observations: T1 T2 futex_hash_allocate() wait_var_event(mm, ...) futex_pivot_pending(mm) hash_new != NULL futex_hash() futex_ref_get(old) -> false futex_pivot_hash(mm) hash_new = NULL __futex_pivot_hash(mm, new) rcu_assign_pointer(hash, new) fph = rcu_dereference(hash) /* new */ futex_ref_is_dead(fph) -> false schedule() The pivot changes the state from hash_new != NULL with a dead current hash to hash_new == NULL with a live current hash. Because futex_pivot_pending() reads hash_new and hash without serialization, the resize task can observe hash_new in the pre-pivot state and hash in the post-pivot state, causing futex_pivot_pending() to return false even though the pivot has completed. The task then goes to sleep after the wakeup has already been consumed. Serialize state reads in futex_pivot_pending() using futex_mm_phash::lock. This guarantees that futex_pivot_pending() observes hash_new and hash atomically, eliminating the race condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80776
EUVD
EUVD-2026-71419

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition in the Linux kernel's futex subsystem during private hash resize operations. A task performing a custom private hash resize can get stuck in uninterruptible sleep indefinitely due to improper synchronization between hash state reads and writes. The issue occurs in futex_pivot_pending() where the function may incorrectly observe stale hash states, causing the task to miss wakeup signals and remain blocked.

Detection Guidance

This vulnerability is specific to the Linux kernel and manifests as a hung task in the futex-resizer process. Check kernel logs for messages like 'INFO: task futex-resizer:314 blocked for more than 10 seconds' or 'Kernel panic - not syncing: hung_task: blocked tasks'.

Impact Analysis

This vulnerability can cause system hangs or kernel panics when the hung-task detector triggers after tasks remain blocked for more than 10 seconds. Systems using custom futex operations with private hash resizing may experience unresponsive processes or require manual reboot to recover.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to a kernel-level race condition in futex operations. Compliance impacts would depend on system-specific configurations and usage rather than this technical flaw.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. Monitor kernel logs for hung tasks and restart affected systems if unresponsive. Ensure futex-related services are updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80776. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart