The vulnerability involves the futex requeue operation in the Linux kernel. Specifically, when FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the target PI futex, the function task_blocks_on_rt_mutex() returns -EDEADLK before setting waiter->task. Subsequently, remove_waiter() in rt_mutex_start_proxy_lock() dereferences the NULL waiter->task pointer, causing a kernel crash. The fix adds a self-deadlock check for non-top waiters analogous to the existing check for top waiters in futex_lock_pi_atomic().

This vulnerability results in a denial of service via a kernel crash caused by a NULL pointer dereference. There is no indication of confidentiality or integrity impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, avoid triggering the vulnerable futex requeue operation with non-top waiters owning the target PI futex. Monitor vendor channels for updates.