{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "80367ad01d93ac781b0e1df246edaf006928002f"
            },
            {
              "fixed": "2b92e5562653b5293529f63b0300837d9dcedbd7"
            },
            {
              "fixed": "f7fb3e07752688842cbe0b85cf0d98c2fbf76b68"
            },
            {
              "fixed": "43b148d796aa338858792d0167cebdc12b8cb4b9"
            },
            {
              "fixed": "59b3732f95dda1fbd2234514d35f4fb6b5bb6d85"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.16.0"
            },
            {
              "fixed": "6.18.47"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.1.11"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "7.2.0"
            },
            {
              "fixed": "7.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80778.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfutex/pi: Reject cross-mm private futex owners\n\nA private futex key borrows the waiter's mm without taking an mm_users\nreference. Nevertheless, attach_to_pi_owner() currently accepts an owner\nfrom a different address space and copies the private key into the owner's\nPI state.\n\nWhen that owner exits, exit_pi_state_list() uses the saved key to find the\nhash bucket and acquires a reference to the waiter's private hash. If the\nlast user of the waiter's mm exits concurrently, futex_hash_free() frees\nthe hash while the owner still uses its bucket and reference.\n\nPrevent this by validating in attach_to_pi_owner() that, for private\nfutexes, the owner mm and waiter mm are the same. Perform the check with\nthe owner's pi_lock held and after validating owner::futex::state to\nserialize against a concurrent PI-state exit cleanup.\n\n[ tglx: Amended comment ]",
  "id": "CVE-2026-80778",
  "modified": "2026-09-06T03:30:48.056102386Z",
  "published": "2026-09-04T15:12:50.117Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/2b92e5562653b5293529f63b0300837d9dcedbd7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/43b148d796aa338858792d0167cebdc12b8cb4b9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/59b3732f95dda1fbd2234514d35f4fb6b5bb6d85"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/f7fb3e07752688842cbe0b85cf0d98c2fbf76b68"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80778.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-80778"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "summary": "futex/pi: Reject cross-mm private futex owners"
}