{"id":"CVE-2026-99218","kind":"vulnerability","aliases":["CVE-2026-99218"],"related":[],"title":"Linux kernel: coredump race can wake a freed thread's memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop.","summary":"A race in the kernel's coredump_finish(): when a process dumps core, parked threads are woken without RCU protection or a task reference, so a thread can exit and be freed first and the wakeup takes a lock in freed memory. NVD rates it CVSS 7.0 (local, low privileges, high complexity). Affects kernels since the coredump code in commit a94e2d408eae (NVD gives 2.6.27) until the fixed releases; matters most on multi-user servers, shared hosts and container hosts where untrusted code can run. Machines with no untrusted local code are lower risk.","severity":"high","cvss":7.0,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":["6.1.191","6.6.161","6.12.115","6.18.60","7.2.14","7.3.1"],"affected":">= 2.6.27, < 6.1.191 (6.1), < 6.6.161 (6.6), < 6.12.115 (6.12), < 6.18.60 (6.18), < 7.2.14 (7.2), < 7.3.1 (7.3)","ecosystem":"linux"}],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted","servers"],"not_affected_if":["core-dumps-disabled","managed-hosting"],"how_to_check":"Run uname -r. If your kernel is in the 6.1, 6.6, 6.12, 6.18, 7.2 or 7.3 series and older than 6.1.191 / 6.6.161 / 6.12.115 / 6.18.60 / 7.2.14 / 7.3.1, it is affected unless your distribution backported the fix; check your distro's changelog or security tracker for CVE-2026-99218. Other series (e.g. 5.x) are not listed by NVD; check your distro.","fix":"Upgrade to a kernel containing the fix: 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 or later in the same series. Fix commits (stable): fd0fbe84312f, 71146c437bae, 0fce73efee40, 16e94ed90b1b, a0f09ff4c6b9, b0eca0edddf4. Distro kernels may backport; check your vendor's advisory.","status":"open","published_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","triaged_at":"2026-11-02T16:26:40+00:00","updated_at":"2026-11-02T16:30:37+00:00","category":"runtime","confidence":0.75,"triage":{"at":"2026-11-02T16:26:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: coredump race can wake a freed thread's memory","impact":"high","summary":"When a process core dump finishes, the kernel wakes parked threads without holding RCU protection, so a thread can exit and be freed before the wakeup runs. The wakeup then touches freed memory, which can crash the kernel or be abused for memory corruption.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted","servers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel memory corruption or crash through use-after-free","analyst_note":"Find the affected and fixed kernel versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99218.","how_to_check":"- `uname -r` to see the running kernel version\n- Check whether the distribution has shipped a kernel with the coredump fix; the sources do not list fixed versions","plain_action":"","needs_analyst":true,"not_affected_if":["core-dumps-disabled","managed-hosting"],"who_is_affected":"Any Linux host that runs a kernel with the affected coredump code can be exposed when processes dump core. Systems where core dumps are disabled or handled entirely by a managed service are less exposed. The sources do not state which kernel versions are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000694,"input_tokens":4280,"output_tokens":532,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the affected and fixed kernel versions and the upstream commit from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-99218.","search":"'-2026':13A,16A '-99218':14A,17A '2.6.27':92B '7.0':75B 'a94e2d408eae':89B 'across':254C 'affect':81B 'away':216C 'call':155C,179C 'clear':147C 'client':221C 'code':86B,111B,119B 'commit':88B 'complex':80B 'contain':107B 'core':41B,151C 'coredump':3A,35B,85B,133C,140C,220C 'cve':12A,15A 'cvss':74B 'doesn':193C 'dump':40B 'enough':210C 'entri':153C 'exit':57B,234C 'finish':36B,141C 'first':61B 'fix':95B 'follow':128C 'freed':8A,60B,69B,237C,250C 'give':91B 'go':215C 'high':79B 'hold':134C,167C,252C 'host':27B,105B,108B 'insid':176C 'isn':187C 'kernel':2A,20A,23B,33B,82B,126C 'leav':199C 'linux':1A,19A,22B,125C 'linux-kernel':18A,21B 'local':76B,118B 'lock':67B,248C 'loop':256C 'low':77B 'lower':121B 'machin':114B 'matter':97B 'meantim':240C 'memori':11A,70B,251C 'multi':101B 'multi-us':100B 'need':195C 'nvd':71B,90B 'park':42B,138C,144C,191C 'pi':247C 'preempt':223C 'preemption':205C 'privileg':78B 'process':39B,158C,182C,230C 'protect':48B 'race':4A,30B 'rate':72B 'rcu':47B,135C,177C,185C,253C 'refer':52B,169C 'releas':96B,137C,142C 'resolv':132C 'risk':122B 'run':113B 'runtim':24B 'safe':189C 'self':26B 'self-host':25B 'server':28B,103B 'share':104B 'sinc':83B 'spurious':201C 'store':208C,226C 'take':65B,246C 'task':51B,148C,172C,183C,213C 'thread':9A,43B,55B,139C,145C,152C,192C,232C 'tri':242C 'untrust':110B,117B 'user':102B 'vulner':129C 'wake':6A,156C,180C,228C,244C 'wakeup':64B,197C,202C 'without':46B,166C,174C,184C 'woken':45B","nicknames":[],"mitigations":[],"who_affected":"Any Linux host that runs a kernel with the affected coredump code can be exposed when processes dump core. Systems where core dumps are disabled or handled entirely by a managed service are less exposed. The sources do not state which kernel versions are affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["linuxkernel"],"ptokens":["kernel","linux"],"labels":["high","linuxkernel","runtime","selfhosted","servers"],"first_public_at":"2026-11-02T16:17:45+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99218","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99218","severity":null,"published_at":"2026-11-02T16:17:45+00:00","modified_at":"2026-11-02T16:17:45+00:00","first_seen_at":"2026-11-02T16:24:05+00:00","fetched_at":"2026-11-02T16:24:05+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99218:1398","url":null,"severity":null,"published_at":"2026-11-02T16:30:37+00:00","modified_at":"2026-11-02T16:30:37+00:00","first_seen_at":"2026-11-02T16:30:37+00:00","fetched_at":"2026-11-02T16:30:37+00:00","note":"NVD record (kernel.org CNA data, status Received) lists fixed stable releases and 6 fix commits; not verified against git.kernel.org pages, distro status unchecked. No exploitation or PoC found."}],"documents":[{"id":52872,"url":"https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-99218","title":"NVD record CVE-2026-99218 (kernel.org CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}