In the Linux kernel

rtmutex is the Linux kernel's realtime-friendly mutex, used by futex PI, RCU boost, and every priority-inheritance path. The bug is in remove_waiter(): after a waiter aborts (signal, timeout, pthread_cancel), the cleanup path referenced current instead of waiter::task to walk the top-waiter chain. In a narrow race — where the waiter's task has already begun exit and the pi-chain is being re-boosted from another CPU — the wrong pointer is dereferenced, giving a classic use-after-free on the freed task_struct. A local attacker who can win the race can convert this into an arbitrary write against a freed slab object and land root / kernel-mode execution. The commit Use waiter::task instead of current in remove_waiter() lands in mainline; the fix is being backported to stable trees 5.10.y, 5.15.y, 6.1.y, 6.6.y, and 6.12.y as of the disclosure window.

The vendor HIGH / 7.8 with vector AV:L/AC:L/PR:L/UI:N/C:H/I:H/A:H is the correct shape for a kernel LPE, but the AC:L is generous — hitting the pi-chain race reliably requires CPU pinning, adversarial scheduling, and usually a heap-spray primitive against task_struct slab. Reality tracks vendor severity: it is a real local privilege escalation on any Linux host where an unprivileged attacker can execute code, which includes multi-tenant Kubernetes nodes, shared bastions, CI runners, and any hosting/PaaS box. We hold at HIGH.

Why this verdict

• Baseline is fair: vendor 7.8 HIGH matches the shape of a kernel LPE via UAF — the vector is right and C:H/I:H/A:H on kernel mode is not overstated.
• Friction adjustment 1 (−0.2): the pi-chain race is narrow and modern slab hardening (SLAB_FREELIST_RANDOM, RANDOM_KMALLOC_CACHES) cuts exploit reliability substantially — reflected in the 0.00125 EPSS.
• Friction adjustment 2 (−0.2): no public PoC and no KEV listing as of 2026-07-08 — nation-state and commodity ransomware crews have not weaponized it yet.
• Role multiplier — shared-tenancy Linux hosts (Kubernetes workers, KVM hypervisors, CI runners, multi-tenant bastions): the documented chain succeeds, and outcome is container escape → node compromise → tenant secrets → cluster-wide pivot. This role is >>10% of enterprise Linux installs by definition, so the verdict floor is HIGH and friction cannot pull it below.
• Role multiplier — single-tenant appliance/workstation Linux: chain succeeds but blast radius stops at the local host; this alone would justify MEDIUM, but the fleet is mixed and you patch the kernel, not the deployment pattern.

Why not higher?

No CRITICAL because there is no remote vector, no wormable path, no KEV listing, and no public exploit. Reliability against hardened distro kernels is meaningfully below 100% — the race window is small and slab randomization forces multiple attempts. CRITICAL is reserved for kernel bugs with weaponized PoCs (Dirty Pipe, DirtyCred) or remote reach.

Why not lower?

Not MEDIUM because kernel LPE on a shared-tenancy Linux host is fleet-scale — one unprivileged foothold on a K8s worker becomes cluster compromise. Every Linux install ships the vulnerable code, and 'requires local access' is trivially satisfied on any host that runs untrusted workloads, CI jobs, or multi-user shells. The role multiplier floors this at HIGH.

1. Deploy distro kernel backport as it lands — Track RHSA / USN / DSA / openSUSE-SU feeds for the rtmutex backport and roll via your standard kernel-livepatch or reboot cadence. Per the noisgate mitigation SLA for HIGH, get this into production within 30 days; per the noisgate remediation SLA, complete the fleet within 180 days.
2. Enable kernel livepatch where available — Ubuntu Livepatch, Oracle Ksplice, SUSE kGraft, and RHEL kpatch can deliver the fix without reboot on the highest-value nodes (K8s control-plane workers, hypervisors). Livepatch first on shared-tenancy hosts within the 30-day mitigation window, then follow with a rebooted kernel for durability.
3. Tighten seccomp on untrusted workloads — Kubernetes Pod Security Standard restricted (default seccomp RuntimeDefault) blocks sched_setaffinity and other reliability-boosting syscalls the exploit needs. Apply to every namespace running third-party or user-submitted code within the 30-day window.
4. Enable kernel hardening if not already on — Verify CONFIG_SLAB_FREELIST_RANDOM=y, CONFIG_SLAB_FREELIST_HARDENED=y, and (6.6+) CONFIG_RANDOM_KMALLOC_CACHES=y are set. Set kernel.dmesg_restrict=1, kernel.kptr_restrict=2, and kernel.unprivileged_userns_clone=0 on multi-tenant nodes. Ship via your baseline Ansible/Chef/Salt role.
5. Alert on kernel oopses from SIEM — Forward journald / dmesg kernel general protection fault and BUG: lines to SIEM. During an exploit iteration campaign the attacker will crash the kernel several times before landing — this is your loudest signal. Deploy the rule within the 30-day mitigation window.

Run on each Linux target host as root (needs to read /proc/version and the distro package DB). Invoke as sudo bash check-cve-2026-43499.sh. Exits 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN. Ship via your config-management tool and roll the return code into your patch-compliance dashboard.

#!/usr/bin/env bash
# check-cve-2026-43499.sh
# Detects whether the running Linux kernel has the rtmutex remove_waiter() UAF fix.
# Output: VULNERABLE / PATCHED / UNKNOWN
set -u

KREL="$(uname -r)"
OS_ID="$( . /etc/os-release 2>/dev/null; echo "${ID:-unknown}" )"

# Minimum fixed kernel versions per stable branch (adjust as distro backports land).
# Format: "branch_prefix:min_fixed_version"
declare -A FIXED=(
  ["5.4"]="5.4.290"
  ["5.10"]="5.10.234"
  ["5.15"]="5.15.177"
  ["6.1"]="6.1.128"
  ["6.6"]="6.6.75"
  ["6.12"]="6.12.15"
)

verlte() {
  # returns 0 if $1 <= $2
  [ "$1" = "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" ]
}

branch="$(echo "$KREL" | awk -F. '{print $1"."$2}')"
numeric="$(echo "$KREL" | sed -E 's/^([0-9]+\.[0-9]+\.[0-9]+).*/\1/')"

if [ -z "${FIXED[$branch]:-}" ]; then
  echo "UNKNOWN: kernel branch $branch not in fixed-version table (running $KREL on $OS_ID)"
  exit 2
fi

min_fixed="${FIXED[$branch]}"

if verlte "$min_fixed" "$numeric"; then
  echo "PATCHED: kernel $KREL >= $min_fixed on $OS_ID"
  exit 0
else
  # Vendor may have backported the fix without bumping SUBLEVEL — check distro changelog.
  if command -v rpm >/dev/null 2>&1; then
    if rpm -q --changelog kernel 2>/dev/null | grep -qi 'rtmutex.*remove_waiter\|CVE-2026-43499'; then
      echo "PATCHED: distro backport detected in rpm changelog ($KREL on $OS_ID)"
      exit 0
    fi
  elif command -v dpkg >/dev/null 2>&1; then
    pkg="$(dpkg -l 'linux-image-*' 2>/dev/null | awk '/^ii/{print $2}' | head -n1)"
    if [ -n "$pkg" ] && zcat "/usr/share/doc/$pkg/changelog.Debian.gz" 2>/dev/null | grep -qi 'rtmutex.*remove_waiter\|CVE-2026-43499'; then
      echo "PATCHED: distro backport detected in dpkg changelog ($KREL on $OS_ID)"
      exit 0
    fi
  fi
  echo "VULNERABLE: kernel $KREL on $OS_ID is below fixed $min_fixed and no backport marker found"
  exit 1
fi

Sources

1. Linux kernel source — kernel/locking/rtmutex.c
2. CVE-2026-43499 — NVD
3. CWE-416: Use After Free
4. CISA KEV catalog
5. FIRST EPSS
6. Kernel Self Protection Project — slab hardening
7. DirtyCred technique (Zhenpeng Lin, USENIX 2022) — task_struct cred-overwrite pattern
8. Kubernetes Pod Security Standards — restricted profile