CVE-2026-99249
pid_namespace: make zap_pid_ns_processes() freezable
- Published
- Updated
- Reserved
- Assigned by
- Linux
Description
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.
Scores
No CVSS score yet: neither the CNA, CISA nor NVD has scored this CVE. NVD status: Received.
- EPSS (exploitation in 30 days)
- 0.16% · top 95% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Not scored.
Affected products
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < 064a6761d6f6ac55d090d3eaca649577ee736713
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < e8dafad7de9ede813af2d48cc04b7c88fef16682
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < 4b47107f1a80c809c80093e872bcaccdbae13db4
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < 2e10b8a74f55b5aae33db105d3e2d3ae759c865a
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < 7deb5770840339fe88755bf27b92f74edc26ee87
- affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 – < 81933038f5e273d17ed22792f906889393b204c5
- affected 2.6.24
- unaffected < 2.6.24
- unaffected 6.1.191 – ≤ 6.1.*
- unaffected 6.6.161 – ≤ 6.6.*
- unaffected 6.12.115 – ≤ 6.12.*
- unaffected 6.18.59 – ≤ 6.18.*
- unaffected 7.2.13 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References (6)
- https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713 (opens in a new tab)
- https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682 (opens in a new tab)
- https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4 (opens in a new tab)
- https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a (opens in a new tab)
- https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87 (opens in a new tab)
- https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-99249)Record last updated .