Description
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.5-1 | — |
| Debian 13 | linux | 3.14.5-1 | — |
| Debian 12 | linux | 3.14.5-1 | — |
| Debian 7 | linux | 3.2.57-3+deb7u2 | DSA-2949-1 |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze7 | DLA-0007-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-29.53 | USN-2240-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.4.2.el7 | RHSA-2014:0786 |
| RHEL 6 | perf +16 | 2.6.32-431.20.3.el6 | RHSA-2014:0771 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.52.1.el6 | RHSA-2014:0800 |
| RHEL 6.4 EUS | perf +15 | 2.6.32-358.46.1.el6 | RHSA-2014:0900 |
| Red Hat MRG 2 | kernel-rt +10 | 3.10.33-rt32.43.el6rt | RHSA-2014:0913 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +11 | 3.10.0-123.4.2.el7 | ELSA-2014-0786 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Android 'Towelroot' Futex Requeue Kernel Exploit
exploit/android/local/futex_requeue
Exploit-DB 1
- Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation EDB-35370 · local · Nov 25, 2014
GitHub 10 repositories
-
timwr/CVE-2014-3153 ★ 124 · Jul 24, 2014
CVE-2014-3153 aka towelroot
-
geekben/towelroot ★ 46 · Sep 20, 2014
Research of CVE-2014-3153 and its famous exploit towelroot on x86
-
dangtunguyen/TowelRoot ★ 21 · Sep 27, 2018
Gain root privilege by exploiting CVE-2014-3153 vulnerability
-
android-rooting-tools/libfutex_exploit ★ 19 · Sep 13, 2014
CVE-2014-3153 exploit
-
lieanu/CVE-2014-3153 ★ 18 · Jan 12, 2015
cve2014-3153 exploit for ubuntu x86
-
elongl/CVE-2014-3153 ★ 14 · Oct 31, 2020
Exploiting CVE-2014-3153, AKA Towelroot.
-
zerodavinci/CVE-2014-3153-exploit ★ 5 · Nov 8, 2015
My exploit for kernel exploitation
-
lastowl/lg-webos2-root ★ 1 · Oct 27, 2026
Persistent root for LG webOS 2.x TVs (CVE-2014-3153)
-
c4mx/Linux-kernel-code-injection_CVE-2014-3153 ★ 0 · Feb 1, 2022
Study on Linux kernel code injection via CVE-2014-3153 (Towelroot)
-
c3c/CVE-2014-3153 ★ 0 · May 29, 2016
towelroot
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2014:0900 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0800 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0786 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0771 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-2240-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2949-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-0007-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2014:0913 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2014-0786 Important: kernel security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- 67906 vdb-entry
- openSUSE-SU-2014:0878 vendor-advisory
- [oss-security] 20140605 Re: Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-list
- 59029 third-party-advisory
- DSA-2949 vendor-advisory
- SUSE-SU-2014:1316 vendor-advisory
- SUSE-SU-2014:0796 vendor-advisory
- 59262 third-party-advisory
- 58990 third-party-advisory
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8
- http://linux.oracle.com/errata/ELSA-2014-3037.html
- 59153 third-party-advisory
- [oss-security] 20140606 Re: Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-list
- 59309 third-party-advisory
- https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8
- 1030451 vdb-entry
- http://linux.oracle.com/errata/ELSA-2014-0771.html
- SUSE-SU-2014:0775 vendor-advisory
- RHSA-2014:0800 vendor-advisory
- USN-2237-1 vendor-advisory
- SUSE-SU-2014:1319 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2014-3039.html
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
- 58500 third-party-advisory
- USN-2240-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1103626
- 59386 third-party-advisory
- 35370 exploit
- 59599 third-party-advisory
- SUSE-SU-2014:0837 vendor-advisory
- [oss-security] 20140605 Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-list
- 59092 third-party-advisory
- http://linux.oracle.com/errata/ELSA-2014-3038.html
- [oss-security] 20210201 Re: Linux Kernel: local priv escalation via futexes mailing-list
- https://www.openwall.com/lists/oss-security/2021/02/01/4
- https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html
- https://github.com/elongl/CVE-2014-3153