CVE-2026-74658

A moderate-impact flaw was found in the Linux kernel's futex subsystem on Red Hat Enterprise Linux and Red Hat In-Vehicle OS. A race condition in robust futex exit handling can lose a one-shot wakeup: when a robust futex unlock wakes a single waiter and that waiter is killed before it can either acquire the futex or re-arm FUTEX_WAITERS, and a third task re-acquires the futex through the uncontended fast path in the meantime, the wakeup notification is lost. The new owner later unlocks without seeing FUTEX_WAITERS and wakes nobody, so the remaining waiters sleep forever behind a free futex. A local attacker with low privileges who can run code participating in the affected futex synchronization could trigger this race, which requires precise timing to exploit, to cause a denial of service by leaving processes in an indefinite sleep; there is no impact on confidentiality or integrity. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. For the affected Red Hat Enterprise Linux 9 (kernel and kernel-rt) and Red Hat Enterprise Linux 10 (kernel) streams and the Red Hat In-Vehicle OS kernel streams, the fix is deferred because the issue has availability-only impact and requires local code execution and a difficult-to-trigger timing race to exploit; it will be addressed in a future update. The residual risk of deferring is a local denial of service in which threads using robust futexes hang permanently.