Linux Kernel RT Mutex Waiter Task Handling Vulnerability in Remove Waiter Function

A vulnerability exists in the Linux kernel's real-time (RT) mutex handling, specifically within the remove_waiter() function. This function is intended to manage task waiters in mutex operations but incorrectly uses the current task context, leading to several issues. The vulnerability affects the Linux kernel stable tree and has been addressed in a recent commit.

Impact

The vulnerability can lead to a use-after-free condition by leaving a dangling pointer after a task is removed from the wait queue, potentially allowing for arbitrary memory access.

Reproduction

The vulnerability can be reproduced by invoking the rt_mutex_start_proxy_lock() function from within a futex_requeue() operation. This scenario will cause the remove_waiter() function to incorrectly process the current task, leading to the described issues.

Remediation

Users can upgrade to the latest version of the Linux kernel stable tree, where this vulnerability has been fixed.