pid_namespace: make zap_pid_ns_processes() freezable

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-99249
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-11-03 12:17:31 UTC
Updated2026-11-03 12:17:31 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 064a6761d6f6ac55d090d3eaca649577ee736713 git Not specified
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 e8dafad7de9ede813af2d48cc04b7c88fef16682 git Not specified
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 4b47107f1a80c809c80093e872bcaccdbae13db4 git Not specified
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 2e10b8a74f55b5aae33db105d3e2d3ae759c865a git Not specified
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 7deb5770840339fe88755bf27b92f74edc26ee87 git Not specified
CNA Linux Linux affected 3eb07c8c8adb6f0572baba844ba2d9e501654316 81933038f5e273d17ed22792f906889393b204c5 git Not specified
CNA Linux Linux affected 2.6.24 Not specified
CNA Linux Linux unaffected 2.6.24 semver Not specified
CNA Linux Linux unaffected 6.1.191 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.161 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.115 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.59 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.13 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report