---
id: 5146
title: "futex: remove_waiter stack uaf"
source_domain: guysrd.github.io
source_url: "https://guysrd.github.io/rtmutex"
published_at: "2026-06-13 00:00"
tags: ["vulnerability-research", "privilege-escalation", "use-after-free", "linux-kernel", "futex"]
phying_url: "https://phying.com/item/5146"
lang: en
---

# futex: remove_waiter stack uaf

## Summary

A stack use-after-free in the Linux futex remove_waiter(), present since 2011, fixed in April 2026, leaves a waiter's pi_blocked_on dangling; the author triggered it but did not reach code execution.

## Intelligence Metadata

- **Sources:** guysrd.github.io
- **Published:** 2026-06-13 00:00
- **Original:** https://guysrd.github.io/rtmutex
- **Phying News:** https://phying.com/item/5146