In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access access_ok() checks… (CVE-2026-99016)

The Linux kernel's RISC-V futex code did not untag user pointers before performing atomic operations, despite access_ok() validating the untagged address. When the tagged address ABI is enabled, the tagged pointer used in atomic operations can overlap with kernel virtual addresses, allowing an unprivileged process to perform atomic read-modify-write operations on arbitrary kernel memory. This occurs because supervisor-mode data accesses do not strip tag bits, and the futex atomic helpers used the raw tagged address. The fix involves untagging the pointer in futex helpers to match the address validated by access_ok().

An unprivileged user process can exploit this vulnerability to perform atomic read-modify-write operations on arbitrary kernel memory addresses, potentially leading to unauthorized kernel memory modification or information disclosure via the FUTEX_OP_CMP_* result as a read oracle. This undermines kernel memory protection and could facilitate privilege escalation or kernel integrity compromise.

A fix has been implemented in the Linux kernel to untag the user pointer before performing atomic futex operations, ensuring the address used matches the one validated by access_ok(). Users should apply the official kernel update that includes this fix to mitigate the vulnerability.