CVE-2026-99169

Description

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address. Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID. Leave private futexes as before to avoid influencing the performance of the hotpath. (Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by setting clear_child_tid such that it points into anonymous memory, which causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)

Is your site exposed to CVE-2026-99169?

Run a free security scan — no signup, results in seconds.

EPSS — Exploit Prediction

0.0018

Probability of exploitation

0.08%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

References

Other References

https://git.kernel.org/stable/c/096b5d4b80d19b1f7bf8e63fae0d0a32dbb6e1a2 https://git.kernel.org/stable/c/0c133ed51700036796318f038dde813976bf1227 https://git.kernel.org/stable/c/16cc0fee39dffd9994b7bea676a886ed52206754 https://git.kernel.org/stable/c/2855ddc6844f527e375e78afb55ec2a5182f23b3 https://git.kernel.org/stable/c/3267512ad1c2cc0c7768c5b014dc2cceb398a801 https://git.kernel.org/stable/c/a7aa4ce1b56a688fe4da75430ec7bf9fe3311807 https://git.kernel.org/stable/c/c17cc2027773e8e4913c5ab0fe3a489b1ed5bf81 https://git.kernel.org/stable/c/f470b76584b5e32d9f9436ef78fb899914116d75

Frequently Asked Questions

What is CVE-2026-99169? +

In the Linux kernel, the following vulnerability has been resolved: futex: Fix mm reuse handling for FUT_OFF_MMSHARED A FUT_OFF_MMSHARED futex is a shared futex that refers to an MM. It is possible for a process to wait on a shared futex with a different MM because a FUT_OFF_INODE waiter can be requeued onto a FUT_OFF_MMSHARED futex by another process. This can cause FUT_OFF_MMSHARED waiters on a freed MM to consume wakeups intended for a newly allocated MM at the same address. Fix it by keying FUT_OFF_MMSHARED using a unique 64-bit per-MM ID. Leave private futexes as before to avoid influencing the performance of the hotpath. (Multi-threaded processes typically implicitly use FUT_OFF_MMSHARED by setting clear_child_tid such that it points into anonymous memory, which causes mm_release() in a multi-threaded mm to perform FUTEX_WAKE.)

How do I check if I'm vulnerable to CVE-2026-99169? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.