VulnerabilityPublished 24 Apr 2026Updated 5 Nov 2026

CVE-2026-31555: Linux kernel · futex: Clear stale exiting pointer in futex_lock_pi() retry path

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in e7824ec168d2ac883a213cd1f4d6cc0816002a85 : update Linux kernel when convenient.

Data as of 5 Nov 2026, 22:06 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · No CVSS score from NVD or the CNA

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-05.

Patch

Available – fixed in e7824ec168d2ac883a213cd1f4d6cc0816002a85, de7c0c04ad868f2cee6671b11c0a6d20421af1da, 71112e62807d1925dc3ae6188b11f8cfc85aec23 +10

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Apr 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 5 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=4.4.255 <4.5 >=4.9.255 <4.10 >=4.14.158 <4.15 >=4.19.172 <4.20 >=5.4.1 <5.5	Fixed in e7824ec168d2ac883a213cd1f4d6cc0816002a85 de7c0c04ad868f2cee6671b11c0a6d20421af1da 71112e62807d1925dc3ae6188b11f8cfc85aec23 33095ae3bdde5e5c264d7e88a2f3e7703a26c7aa 7475dfad10a05a5bfadebf5f2499bd61b19ed293 210d36d892de5195e6766c45519dfb1e65f3eb83 92e47ad03e03dbb5515bdf06444bf6b1e147310d 5e8e06bf8909e79b4acd950cf578cfc2f10bbefa 5.5 4.20 4.15 4.10 4.5
LinuxLinux	Affected =5.5	Fixed in–

AI-suggested

A fix is available and has been applied in Linux kernel versions 5.5 and 4.20 and corresponding commits. Users and administrators should update to these fixed versions or later to remediate this issue. No additional mitigation steps are indicated beyond applying the official patch.

Description

CVE-2026-31555 is a vulnerability in the Linux kernel's futex subsystem where a stale pointer is not cleared in the futex_lock_pi() retry path. This can lead to a warning and potential instability when the kernel attempts to handle futex locking and owner exiting scenarios. The issue arises because a reference to a task pointer remains set after being consumed, causing a stale pointer to be passed on retry attempts. This flaw has been fixed by resetting the pointer upon retry, aligning behavior with the requeue_pi mechanism.

Impact

The vulnerability can cause kernel warnings and potentially unstable behavior related to futex locking when the owner task is exiting. While no direct exploit or active exploitation is reported, the stale pointer usage could lead to kernel warnings and possibly impact system stability or reliability under stress conditions involving futexes.

Summary

The Linux kernel futex subsystem had a flaw in futex_lock_pi() where, upon detecting the owner is exiting, a reference-counted task pointer was stored but not cleared after consumption. On retry, if futex_lock_pi_atomic() returned a different error, the stale pointer was used again, triggering warnings and potential kernel instability. The fix involves resetting the pointer on retry to prevent use of stale references. This vulnerability affects multiple Linux kernel versions and has been resolved in specific fixed commits and versions including 5.5 and 4.20.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Nov 2026, 22:06 UTC

Technical details

References

Community reviews

Related threats