SECURITY ANNOUNCEMENT

CVE-2026-99016

23 October 2026

get_user()/put_user()/raw_copy_{to,from}_user() already untag the pointer after the access_ok() check; do the same in the futex helpers so the atomic operates on the address that was actually validated.

Introduced

6.132e1743085887ba3f553c2bb472a75a3ff744b242

Fixed releases

6.18.572e5c80bbc062a8dda33e687ebf7be8f074ee4f7d

7.2.118e48d8d51ab37b7decfbff3e2844e027a52ad6ea

7.3405290be962b32eec842776fbe3bdf81f15b1676

View source announcement ↗