Exploit for Use After Free in Linux Linux_Kernel CVE-2026-43499

## https://sploitus.com/exploit?id=8CB74C97-A3C4-5879-82BA-E06AE777993B
# CVE-2026-43499 — Linux Kernel Futex PI Use-After-Free

## Bug

`remove_waiter()` in `kernel/locking/rtmutex.c` is used by the slowlock paths but also for proxy-lock rollback in `rt_mutex_start_proxy_lock()` when invoked from `futex_requeue()`.

In the proxy-lock case `waiter::task` is not `current`, but `remove_waiter()` incorrectly operates on `current`. This causes three problems:

1. The rbtree dequeue happens without `waiter::task::pi_lock` being held.
2. The waiter task's `pi_blocked_on` is not cleared, leaving a dangling pointer primed for use-after-free.
3. `rt_mutex_adjust_prio_chain()` operates on the wrong task.

**CWE-416** (Use After Free). CVSS 3.1: **7.8 HIGH** (Local, Low complexity, Low privileges required).

Affected: Linux 2.6.39 through 6.18.x; patched in 6.1.175, 6.6.140, 6.12.86, 6.18.27, 7.0.4.

## PoC for Xiaomi Mi 11T (amber / agate)

Non-escalating validation harness for the authorized test device only.  
**Reproducible package:** [`test_package/`](test_package/) (build, hashes, ADB steps, disclosure).

**Prerequisites:** Android NDK r27+, `adb`. On Windows: `.\build.ps1`.

```powershell
.\build.ps1
adb push build/ghostlock_validate /data/local/tmp/ghostlock_validate
adb shell chmod 755 /data/local/tmp/ghostlock_validate

# Safe default (recommended)
adb shell /data/local/tmp/ghostlock_validate --dry-run --retries 3

# Optional crash probe (may panic) — not for privilege escalation
# adb shell /data/local/tmp/ghostlock_validate --probe --retries 1
```

`--dry-run` success: `EDEADLK=1` + `DRY_RUN_STOP_BEFORE_CORRUPTION=1`.  

**Proof package (what is / is not demonstrated on this phone):** [`evidence/PROOF.md`](evidence/PROOF.md)  
**Vendor package (dry-run transcripts + disclosure bundle):** [`evidence/vendor_package_20260726/`](evidence/vendor_package_20260726/)  
Vendor disclosure: `test_package/docs/VENDOR_DISCLOSURE.md`.  
Other-device public repos (reference only, not applicable to amber): [`evidence/OTHER_DEVICE_REPOS.md`](evidence/OTHER_DEVICE_REPOS.md)  
No credential / SELinux / CFI / root stages are implemented.

## Credits

**Reported by:**
- Yuan Tan
- Yifan Wu
- Juefei Pu
- Xin Liu

**Fix authored by:** Keenan Dong  
**Fix committed by:** Thomas Gleixner  
**Commit:** [`3bfdc63`](https://github.com/torvalds/linux/commit/3bfdc63936dd4773109b7b8c280c0f3b5ae7d349) — rtmutex: Use waiter::task instead of current in remove_waiter()