Live › vulnerability › CVE-2026-99218
A race in the kernel's coredump_finish(): when a process dumps core, parked threads are woken without RCU protection or a task reference, so a thread can exit and be freed first and the wakeup takes a lock in freed memory. NVD rates it CVSS 7.0 (local, low privileges, high complexity). Affects kernels since the coredump code in commit a94e2d408eae (NVD gives 2.6.27) until the fixed releases; matters most on multi-user servers, shared hosts and container hosts where untrusted code can run. Machines with no untrusted local code are lower risk.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 16:24 UTC. All times on this page are UTC.
Any Linux host that runs a kernel with the affected coredump code can be exposed when processes dump core. Systems where core dumps are disabled or handled entirely by a managed service are less exposed. The sources do not state which kernel versions are affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| linux-kernel | linux | >= 2.6.27, < 6.1.191 (6.1), < 6.6.161 (6.6), < 6.12.115 (6.12), < 6.18.60 (6.18), < 7.2.14 (7.2), < 7.3.1 (7.3) | 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 |
6.1.191 / 6.6.161 / 6.12.115 / 6.18.60 / / , it is affected unless your distribution backported the fix; check your distro's changelog or security tracker for CVE-2026-992187.2.147.3.16.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 or later in the same seriesEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
coredump: hold RCU while releasing parked threads
coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu.
But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away.
So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory.
Hold rcu across the loop.
This page as .md · .json · in your agent: get_signal("CVE-2026-99218")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.