Intel

CVE-2026-43499

Siemens ProductCERT Advisory SSA-019113

highPoCEPSS 0.8%

Description

In the Linux kernel, the following vulnerability has been resolved: rtmutex: Use waiter::task instead of current in remove_waiter() remove_waiter() is used by the slowlock paths, but it is also used for proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from futex_requeue(). In the latter case waiter::task is not current, but remove_waiter() operates on current for the dequeue operation. That results in several problems: 1) the rbtree dequeue happens without waiter::task::pi_lock being held 2) the waiter task's pi_blocked_on state is not cleared, which leaves a dangling pointer primed for UAF around. 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter task Use waiter::task instead of current in all related operations in remove_waiter() to cure those problems. [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the changelog ]

Source: BSIBSI_CSAFSIEMENS_ADVISORYUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNBSIBSI_CSAFUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNUBUNTU_USNCVELISTV5NVDCVEORGEUVDMSRC

Metrics

Severity
high
Priority score
217.94
KEV status
—
Exploit maturity
PoC (publicly reported)
XIEM Effective CVSS
7.8
Source: nvd-v3
CVSS v3
7.8
CVSS v4
—
EPSS percentile
54.1 %
High — this CVE ranks above the median of all CVEs scored today (rank ≥ 36%).
EPSS score
0.8 %
Low — model estimates < 1% exploitation likelihood.
Published
2021-09-26 00:00 UTC
CWE
—

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-09-08 09:18 UTC· 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
    • Affected: New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/43xxx/CVE-2026-43499.json">CVE-2026-43499</a>
    • Reference: https://cert-portal.siemens.com/productcert/html/ssa-019113.html
  2. CVE Modified2026-08-22 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-43499","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"no"},{"technicalIm…
  3. CVE Modified2026-07-24 15:17 UTC· 416baaa9-dc9f-4396-8d5f-8c081fb06d67
    • Reference: https://git.kernel.org/stable/c/838ce5cb5d93c3ab8b27e75bc6ad905a94b752fd
    • Reference: https://git.kernel.org/stable/c/f3fa3424bceb128d2be4b3745506b22844b87db7
    • Affected: Linux, Linux → Linux, Linux
  4. CVE Translated2026-07-23 16:10 UTC· nvd@nist.gov
    • Translation: Title: el kernel de Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: rtmutex: Usar waiter::task en lugar de current en remove_waiter() remove_waiter() es usado por las rutas de slowlock, pero también es usado para la reversión de bloqueo de proxy en rt_mutex_start_proxy_lock() cuando es invocado desde futex_requeue(). En este último caso, waiter::task no es current, pero remove_waiter() opera en current para la operación de desencolado. Eso resulta en varios problemas: 1) el desencolado de rbtree ocurre sin que waiter::task::pi_lock esté retenido 2) el estado pi_blocked_on de la tarea de espera no se borra, lo que deja un puntero colgante preparado para UAF. 3) rt_mutex_adjust_prio_chain() opera en la tarea de espera de máxima prioridad incorrecta Usar waiter::task en lugar de current en todas las operaciones relacionadas en remove_waiter() para solucionar esos problemas. [ tglx: Corregir rt_mutex_adjust_prio_chain(), añadir un comentario y modificar el registro de cambios ]
  5. CVE Modified2026-07-08 23:16 UTC· af854a3a-2127-422b-91ae-364da2661108
    • Reference: http://www.openwall.com/lists/oss-security/2026/07/08/12

Affected operating systems

  • linux

    amazon / amazon_linux

  • linux

    ubuntu / awsbionic

  • linux

    ubuntu / awsjammy

  • linux

    ubuntu / awsnoble

  • linux

    ubuntu / awsresolute

  • linux

    ubuntu / awsxenial

  • linux

    ubuntu / aws-6.8jammy

  • linux

    ubuntu / aws-hwexenial

  • linux

    ubuntu / azurejammy

  • linux

    ubuntu / azurenoble

  • linux

    ubuntu / azureresolute

  • linux

    ubuntu / azurexenial

  • linux

    ubuntu / azure-4.15bionic

  • linux

    suse / basesystem_module15

  • linux

    debian / debian_linux11.0

  • linux

    debian / debian_linux12.0

  • linux

    debian / debian_linux13.0

  • linux

    suse / development_tools_module15

  • linux

    redhat / enterprise_linux10.0

  • linux

    redhat / enterprise_linux7.0

  • linux

    redhat / enterprise_linux8.0

  • linux

    redhat / enterprise_linux9.0

  • linux

    redhat / enterprise_linux_aus8.4

  • linux

    redhat / enterprise_linux_aus8.6

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • arista

    cloudvision_agni2024.4.0 – 2025.2.2

  • arista

    cloudvision_portal2024.2.0 – 2026.1.0

  • arista

    velocloud_edge4.5.0 – 6.4.1

  • arista

    velocloud_gateway

  • arista

    velocloud_orchestrator

  • canonical

    ubuntu_linux

  • Citrix Systems

    Hypervisor8.2 CU1 LTSR

  • Citrix Systems

    XenServer8.4

  • Dell

    ECS3.8.1.0-3.8.1.7

  • Dell

    NetWorkerVirtual Edition

  • Dell

    NetWorkervProxy 19.13.0.3

  • Dell

    NetWorkervProxy 19.14

  • Dell

    PowerScale OneFS13.2.3

  • Dell

    PowerScale OneFSOneFS

  • Dell

    Secure Connect GatewayAppliance 5.32.00.18

  • gnupg

    libgcrypt1.11.0 – 1.11.3

  • gnupg

    libgcrypt1.12.0 – 1.12.2

  • gnupg

    libgcrypt1.8.8 – 1.10.4

  • Intel

    ProzessorCore Ultra 5

  • Intel

    ProzessorCore Ultra 7

  • Intel

    ProzessorCore Ultra 9

  • julia

    openssh_jll

  • netapp

    active_iq_unified_manager

  • netapp

    clustered_data_ontap

References & sources

Linked CVEs

Show 406 more CVEs

Linked advisories

IDCVE-2026-43499
Siemens ProductCERT Advisory SSA-019113 — CVE-2026-43499 | NEOSEC Intel