CVE-2026-99244
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
What happened?
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits.
But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes.
The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately.
Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.
Affected software and versions
| Software | Version information | Fixed version |
|---|---|---|
| LinuxLinux | affected: edd2754a62bee8d97b4808a15de024f66a1ddccf to < 2c20ace1698d03a23467351be1d281e89b36ade3; affected: 3466abafa9f4f81a869da828e52a12f693175ec2 to < 9ab0324f4868eeb20c63f063a1e5bc01d5539212; affected: 7fea700e04bd3f424c2d836e98425782f97b494e to < 30b274508c743f243c82904954c4e416d7143d4c; affected: 7fea700e04bd3f424c2d836e98425782f97b494e to < 70178691c467c8f9f722765299fd8524c3121a35; affected: 7fea700e04bd3f424c2d836e98425782f97b494e to < 3d15ac36ce174477efa5365e424dbd47950fd2b9; affected: 7fea700e04bd3f424c2d836e98425782f97b494e to < f46cd8241d9b83f2279cc0db3e9d3e181b548a59; affected: 7fea700e04bd3f424c2d836e98425782f97b494e to < 5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2; affected: 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8; affected: 8e69e589f233ca2c9631f5af2b94f95dfc2ba804; affected: 09ab5b424b17cfe633db58bb2f9edbaf9484cf20; affected: 6.1.95 to < 6.1.191; affected: 6.6.35 to < 6.6.161; affected: 5.10.221 to < 5.11; affected: 5.15.162 to < 5.16; affected: 6.9.6 to < 6.10 | See vendor advisory |
| LinuxLinux | affected: 6.10; unaffected: 0 to < 6.10; unaffected: 6.1.191 to ≤ 6.1.*; unaffected: 6.6.161 to ≤ 6.6.*; unaffected: 6.12.115 to ≤ 6.12.*; unaffected: 6.18.60 to ≤ 6.18.*; unaffected: 7.2.14 to ≤ 7.2.*; unaffected: 7.3.1 to ≤ 7.3.*; unaffected: 7.4-rc1 to ≤ * | See vendor advisory |
Version information comes from the source record and can include unaffected products and exceptions. Distribution packages may contain backported fixes: an older upstream version alone does not prove a server is affected.
Is it being exploited?
This CVE was not listed in the CISA catalogue at our last retrieval. This does not establish that exploitation is absent.
How to respond
- Confirm the product, installed package version, and any configuration requirements in the vendor advisory.
- Follow the vendor’s remediation or workaround guidance in the references below. Structured fixed-version data is unavailable here; the publisher’s description may include a fix or workaround.
- Restart affected services if required, then verify the running version. Known exploitation may warrant investigation as well as patching.
Sources and remediation references
- https://www.cve.org/CVERecord?id=CVE-2026-99244
- https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3
- https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212
- https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c
- https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35
- https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9
- https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59
- https://git.kernel.org/stable/c/5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2