The Linux kernel vulnerability CVE-2026-43499 concerns the rtmutex subsystem where remove_waiter() incorrectly uses the current task context instead of waiter::task during proxy-lock rollback invoked from futex_requeue(). This misuse causes three main problems: (1) the rbtree dequeue operation occurs without holding the necessary pi_lock on waiter::task, (2) the pi_blocked_on state of the waiter task is not cleared, resulting in a dangling pointer and potential use-after-free (CWE-416), and (3) rt_mutex_adjust_prio_chain() operates on an incorrect top priority waiter task. The fix replaces current with waiter::task in all relevant operations in remove_waiter(), addressing these concurrency and memory safety issues.

The vulnerability can lead to use-after-free conditions and incorrect priority handling within the kernel's real-time mutex implementation. This may cause kernel instability, data corruption, or escalation of privileges due to improper synchronization and memory management. The CVSS vector indicates local attack complexity with low privileges required and no user interaction, with high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch links are provided in the available data. Users should monitor for vendor updates and apply official kernel updates once available to address this vulnerability.