---
id: 5147
title: "The futex READ_ONCE"
source_domain: guysrd.github.io
source_url: "https://guysrd.github.io/futex-read-once"
published_at: "2026-06-04T00:00:00Z"
tags: ["vulnerability-research", "memory-safety", "linux-kernel", "race-condition", "futex"]
phying_url: "https://phying.com/item/5147"
lang: en
---

# The futex READ_ONCE

## Summary

A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.

## Intelligence Metadata

- **Sources:** guysrd.github.io
- **Published:** 2026-06-04T00:00:00Z
- **Original:** https://guysrd.github.io/futex-read-once
- **Phying News:** https://phying.com/item/5147