CVE-2026-99218
coredump: hold RCU while releasing parked threads
What happened?
In the Linux kernel, the following vulnerability has been resolved:
coredump: hold RCU while releasing parked threads
coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu.
But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away.
So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory.
Hold rcu across the loop.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < fd0fbe84312fda2fc187428c92c50b7d03a9d24c; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 71146c437bae59e5280f657965dc6d006ee3989b; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 0fce73efee40c65ce26641c5d93942462f9e8307; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 16e94ed90b1b02398e044d41fd1db34828daa08e; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573; affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 61d58591aa0188bf2463e263962256316ff8b576 | See vendor advisory |
| LinuxLinux | affected: 2.6.27; unaffected: 0 to < 2.6.27; unaffected: 6.1.191 to ≤ 6.1.*; unaffected: 6.6.161 to ≤ 6.6.*; unaffected: 6.12.115 to ≤ 6.12.*; unaffected: 6.18.60 to ≤ 6.18.*; unaffected: 7.2.14 to ≤ 7.2.*; unaffected: 7.3.1 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99218
- https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c
- https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b
- https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307
- https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e
- https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c
- https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573
- https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576