CVE-2026-43499: Use-After-Free in Linux kernel rtmutex

CVE-2026-43499 is a Use-After-Free vulnerability in the rtmutex module of the Linux kernel. The flaw resides in remove_waiter(), a function used in slowlock paths and in the proxy-lock rollback of rt_mutex_start_proxy_lock(). The defect causes three critical issues: rbtree dequeue occurs without pi_lock protection; the waiter task's pi_blocked_on state is not cleared, creating a dangling pointer; rt_mutex_adjust_prio_chain() operates on the wrong task.

The vulnerability has a CVSS score of 7.8 (HIGH) according to NVD, published on May 21, 2026. Current signals show active interest in exploitation: in November 2026, a public repository was detected declaring work on exploits for this flaw, specifically for Redmi K40 Gaming devices running kernel 4.14.186, although in work-in-progress state. This indicates that the researcher community considers the flaw exploitable.

Defenders must first verify which version of the Linux kernel is running on critical systems and enterprise endpoints. It is essential to consult advisories from the kernel maintainer and your Linux distribution to identify whether your systems fall within vulnerable versions. Once identified, administrators must plan kernel updates to the correct version implementing the fix: the use of waiter::task instead of current in remove_waiter() and rt_mutex_adjust_prio_chain().