Skip to content
The futex READ_ONCE
guysrd.github.io | blog | #vulnerability-research | #memory-safety | #linux-kernel | #race-condition | #futex
Summary
A missing READ_ONCE in futex requeue_pi_wake_futex creates a one-instruction race letting the requeuer dereference a dead stack frame, giving a controlled 8-byte addition from unprivileged userspace.
- Published
- Collected