CVE-2026-99249 - Vulnerability Details

Vendors	Products
Linux	Linux Linux Kernel

Link	Providers
https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713
https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a
https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4
https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87
https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5
https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682

Type	Values Removed	Values Added
Weaknesses		CWE-665

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE \| TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE \| TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.
Title		pid_namespace: make zap_pid_ns_processes() freezable
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713 https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4 https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87 https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5 https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99249", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.403Z", "datePublished": "2026-11-03T11:18:26.800Z", "dateUpdated": "2026-11-03T11:18:26.800Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-11-03T11:18:26.800Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer's fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/exit.c", "kernel/pid_namespace.c"], "versions": [{"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "064a6761d6f6ac55d090d3eaca649577ee736713", "status": "affected", "versionType": "git"}, {"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "e8dafad7de9ede813af2d48cc04b7c88fef16682", "status": "affected", "versionType": "git"}, {"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "4b47107f1a80c809c80093e872bcaccdbae13db4", "status": "affected", "versionType": "git"}, {"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "2e10b8a74f55b5aae33db105d3e2d3ae759c865a", "status": "affected", "versionType": "git"}, {"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "7deb5770840339fe88755bf27b92f74edc26ee87", "status": "affected", "versionType": "git"}, {"version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "lessThan": "81933038f5e273d17ed22792f906889393b204c5", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/exit.c", "kernel/pid_namespace.c"], "versions": [{"version": "2.6.24", "status": "affected"}, {"version": "0", "lessThan": "2.6.24", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.24", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713"}, {"url": "https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682"}, {"url": "https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4"}, {"url": "https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a"}, {"url": "https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87"}, {"url": "https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5"}], "title": "pid_namespace: make zap_pid_ns_processes() freezable", "x_generator": {"engine": "bippy-1.2.0"}}}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/exit.c", "kernel/pid_namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "064a6761d6f6ac55d090d3eaca649577ee736713", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}, {"lessThan": "e8dafad7de9ede813af2d48cc04b7c88fef16682", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}, {"lessThan": "4b47107f1a80c809c80093e872bcaccdbae13db4", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}, {"lessThan": "2e10b8a74f55b5aae33db105d3e2d3ae759c865a", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}, {"lessThan": "7deb5770840339fe88755bf27b92f74edc26ee87", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}, {"lessThan": "81933038f5e273d17ed22792f906889393b204c5", "status": "affected", "version": "3eb07c8c8adb6f0572baba844ba2d9e501654316", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/exit.c", "kernel/pid_namespace.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.24"}, {"lessThan": "2.6.24", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer's fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump."}], "id": "CVE-2026-99249", "lastModified": "2026-11-03T12:17:31.460", "metrics": {}, "published": "2026-11-03T12:17:31.460", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

Metrics

Affected Vendors & Products

Metrics

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object