From 0e6a39b07409003cca5566287b70e8a23a9663be Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Fri, 10 Jul 2026 13:10:57 -0400 Subject: [PATCH 1/2] futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" cve-bf CVE-2026-53166 commit-author Sebastian Andrzej Siewior commit 39def6d250d370298f86c116f4ac60093cefadaa The commit cited below should not have been merged. It attemted to fix an existing problem ansd thereby introduced new problems by keeping the pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. Based on the commit description the intention was to handle the case when task_blocks_on_rt_mutex() returns -EDEADLK and the following remove_waiter() dereferences the NULL pointer in waiter->task. That is already handled by Davidlohr in commit 40a25d59e85b3 ("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and requires no further acting. Revert the commit breaking the "waiter == owner" case again. Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") Reported-by: Michael Bommarito Signed-off-by: Sebastian Andrzej Siewior Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com (cherry picked from commit 39def6d250d370298f86c116f4ac60093cefadaa) Signed-off-by: Brett Mastbergen --- kernel/futex/requeue.c | 6 ------ 1 file changed, 6 deletions(-) diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c index 1d99a84dc9adb..b597cb3d17fc1 100644 --- a/kernel/futex/requeue.c +++ b/kernel/futex/requeue.c @@ -643,12 +643,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, continue; } - /* Self-deadlock: non-top waiter already owns the PI futex. */ - if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { - ret = -EDEADLK; - break; - } - ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, this->rt_waiter, this->task); From b1a607d8198117b4b9399e715c72728569939efe Mon Sep 17 00:00:00 2001 From: Brett Mastbergen Date: Fri, 10 Jul 2026 13:11:25 -0400 Subject: [PATCH 2/2] [CIQ] ciq_kernel-6.18.38-2 - updated spec --- ciq/SPECS/kernel-clk6.18.spec | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/ciq/SPECS/kernel-clk6.18.spec b/ciq/SPECS/kernel-clk6.18.spec index 994cd5e842262..45f03d4a83eaa 100644 --- a/ciq/SPECS/kernel-clk6.18.spec +++ b/ciq/SPECS/kernel-clk6.18.spec @@ -171,7 +171,7 @@ Summary: The Linux kernel %define kernel_patch 38 %define buildid .1 %define specversion %{kernel_major_minor}.%{kernel_patch} -%define pkgrelease 1%{?buildid} +%define pkgrelease 2%{?buildid} %define kversion %{lua:print((rpm.expand("%{kernel_major_minor}"):match("^(%d+)")))} %define tarfile_release %{specversion}-%{pkgrelease}.el%{el_version} @@ -4575,6 +4575,10 @@ fi\ # # %changelog +* Fri Jul 10 2026 Brett Mastbergen - 6.18.38-2.1.el9 +-- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Brett Mastbergen) +-- Add x86_64 minimal kernel variant to spec (Brett Mastbergen) + * Sun Jul 05 2026 github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> - 6.18.38-1.1.el9 -- Rebased changes for Linux 6.18.38 (https://github.com/ctrliq/kernel-src-tree/releases/tag/ciq_kernel-6.18.38-1) -- [CIQ] v6.18.36 - updated spec (Brett Mastbergen)