VulnerabilityPublished 22 Aug 2026Updated 6 Nov 2026

CVE-2026-74658: Linux kernel · futex: Prevent robust futex exit race some more

Affects Linux kernelSource CVE Database V5

Compare

Not known to be exploited · fixed in aa5c571901c6b22b58373693a4bf889ecab11ff5 : update Linux kernel when convenient.

Data as of 6 Nov 2026, 17:48 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation: No evidence of active exploitation and no public proof of concept
Automatable: Attackers cannot reliably automate steps 1–4 of the kill chain
Technical impact: Limited control over the software or limited information exposure

CISA SSVC assessment, 2026-11-06.

Patch

Available – fixed in aa5c571901c6b22b58373693a4bf889ecab11ff5, a1c2b7b86a946b6b172bce44d74553da2323a36c, 925628656b73b70930972ccde421de4f758d8650 +11

Exploitation evidence

Disclosed: evidence found.
CVE published 22 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected >=3.16.82 <3.17 >=4.9.264 <4.10 >=4.14.158 <4.15 >=4.19.87 <4.20 >=5.3.14 <5.4 >=5.4.1 <5.5	Fixed in aa5c571901c6b22b58373693a4bf889ecab11ff5 a1c2b7b86a946b6b172bce44d74553da2323a36c 925628656b73b70930972ccde421de4f758d8650 83b0f71d5a313a765754acab51d2ecc5de76e0b9 33bfa85458105d6169ebdb697f692b8bb8025bae 7cf710e70f9bb8ea75f759ebed09871801315992 7b8c53263f8878bdd12c87e147ac6feca5c05211 6d4514ca9cdf61fec4ec634cf50386f6f7e69748 5.5 5.4 4.20 4.15 4.10 3.17
LinuxLinux	Affected =5.5	Fixed in–

AI-suggested

A fix for this vulnerability is available and has been incorporated into Linux kernel versions 5.4, 5.5, and other specified versions. Users and administrators should upgrade to these fixed versions to mitigate the issue. No additional mitigation steps are required beyond applying the official kernel updates.

Description

CVE-2026-74658 is a vulnerability in the Linux kernel's futex implementation related to robust futex exit race conditions. The flaw involves the handling of the FUTEX_WAITERS bit during robust futex unlock operations, which can lead to a lost wakeup notification and cause some waiters to sleep indefinitely. This issue arises when a woken waiter is killed before it can re-arm FUTEX_WAITERS or acquire the futex, and another task acquires the futex via the uncontended fast path, resulting in waiters being left asleep behind a free futex. The vulnerability has been addressed by augmenting the robust list exit processing to perform an extra wakeup if needed. The fix is included in Linux kernel versions 5.4 and 5.5 and several other versions as specified.

Impact

The impact of this vulnerability is that tasks waiting on a futex may sleep indefinitely due to lost wakeup notifications, potentially causing deadlocks or hangs in applications relying on futex synchronization. This can degrade system stability and responsiveness but does not directly lead to privilege escalation or code execution. There are no known exploits in the wild.

Summary

The vulnerability in the Linux kernel futex subsystem involves a race condition during robust futex exit processing. When a robust futex is unlocked, the FUTEX_WAITERS bit is cleared and a single waiter is woken. If the woken waiter is killed before it can act, and another task acquires the futex uncontended, the notification is lost. This causes remaining waiters to sleep indefinitely, effectively causing a deadlock scenario. The issue stems from inconsistent maintenance of the FUTEX_WAITERS bit. The fix augments the robust list exit processing to perform an additional wakeup if the futex is owned by another thread but FUTEX_WAITERS is not set. This patch addresses the immediate problem but does not fully resolve all related futex contention and release issues, which are being addressed in ongoing kernel development.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 6 Nov 2026, 17:48 UTC

Technical details

References

Community reviews

Related threats