This vulnerability in the Linux kernel concerns the rtmutex locking code, specifically the remove_waiter() function. A null pointer dereference was triggered by syzbot during FUTEX_CMP_REQUEUE_PI operations due to waiter->task being nil. The problem originated because task_blocks_on_rt_mutex() did not arm the waiter on deadlock detection, and a prior patch made remove_waiter() rely on waiter::task, causing a fatal error. Furthermore, rt_mutex_start_proxy_lock() was calling remove_waiter() incorrectly after successful lock acquisition. The fix involved skipping remove_waiter() when the waiter is not enqueued and tightening the checks in rt_mutex_start_proxy_lock() to avoid unnecessary calls to remove_waiter().

The vulnerability causes a kernel null pointer dereference leading to a kernel crash (splat) when handling futex requeue operations involving real-time mutexes. This can result in denial of service due to kernel panic or instability. There is no information about privilege escalation or code execution. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a Linux kernel vulnerability, monitor official Linux kernel mailing lists and vendor advisories for patches addressing CVE-2026-53163. Apply official kernel updates once available to remediate this issue.