Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: futex/pi: Reject cross-mm private futex owners A private futex key borrows the… (CVE-2026-80778)

The vulnerability in the Linux kernel's futex/pi subsystem arises because a private futex key borrows the waiter's memory manager (mm) without incrementing its reference count. The function attach_to_pi_owner() incorrectly accepts an owner from a different address space and copies the private key into the owner's priority inheritance (PI) state. When the owner exits, exit_pi_state_list() uses the saved key to find the hash bucket and acquires a reference to the waiter's private hash. If the waiter's mm is concurrently freed, futex_hash_free() frees the hash while the owner still holds a reference, leading to a use-after-free condition. The patch validates in attach_to_pi_owner() that the owner mm and waiter mm are the same for private futexes, performing the check with proper locking and state validation to prevent concurrent cleanup races.

This vulnerability could lead to use-after-free conditions within the kernel futex subsystem, potentially causing memory corruption or kernel crashes. No known exploits in the wild have been reported. The impact is limited to kernel stability and security related to futex operations involving private futexes across different memory contexts.

A fix has been implemented in the Linux kernel to validate that private futex owners and waiters belong to the same memory context, preventing cross-mm private futex ownership. Users should apply the official kernel updates that include this patch to remediate the vulnerability. Since no patch links or vendor advisories are provided, check the official Linux kernel repositories or vendor advisories for the relevant fixed kernel versions.