---
id: "CVE-2026-99218"
kind: "vulnerability"
aliases: ["CVE-2026-99218"]
title: "Linux kernel: coredump race can wake a freed thread's memory"
severity: "high"
cvss: 7.0
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "linux-kernel", "fixed": ["6.1.191", "6.6.161", "6.12.115", "6.18.60", "7.2.14", "7.3.1"], "affected": ">= 2.6.27, < 6.1.191 (6.1), < 6.6.161 (6.6), < 6.12.115 (6.12), < 6.18.60 (6.18), < 7.2.14 (7.2), < 7.3.1 (7.3)", "ecosystem": "linux"}]
ecosystems: []
tags: ["linux-kernel", "runtime", "self-hosted", "servers"]
not_affected_if: ["core-dumps-disabled", "managed-hosting"]
published_at: "2026-11-02T16:17:45+00:00"
first_seen_at: "2026-11-02T16:24:05+00:00"
updated_at: "2026-11-02T16:30:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99218", "first_seen_at": "2026-11-02T16:24:05+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-02T16:30:37+00:00"}]
---

# Linux kernel: coredump race can wake a freed thread's memory

A race in the kernel's coredump_finish(): when a process dumps core, parked threads are woken without RCU protection or a task reference, so a thread can exit and be freed first and the wakeup takes a lock in freed memory. NVD rates it CVSS 7.0 (local, low privileges, high complexity). Affects kernels since the coredump code in commit a94e2d408eae (NVD gives 2.6.27) until the fixed releases; matters most on multi-user servers, shared hosts and container hosts where untrusted code can run. Machines with no untrusted local code are lower risk.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- linux:linux-kernel affected >= 2.6.27, < 6.1.191 (6.1), < 6.6.161 (6.6), < 6.12.115 (6.12), < 6.18.60 (6.18), < 7.2.14 (7.2), < 7.3.1 (7.3) fixed 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1

## How to check

Run uname -r. If your kernel is in the 6.1, 6.6, 6.12, 6.18, 7.2 or 7.3 series and older than 6.1.191 / 6.6.161 / 6.12.115 / 6.18.60 / 7.2.14 / 7.3.1, it is affected unless your distribution backported the fix; check your distro's changelog or security tracker for CVE-2026-99218. Other series (e.g. 5.x) are not listed by NVD; check your distro.

## Fix

Upgrade to a kernel containing the fix: 6.1.191, 6.6.161, 6.12.115, 6.18.60, 7.2.14, 7.3.1 or later in the same series. Fix commits (stable): fd0fbe84312f, 71146c437bae, 0fce73efee40, 16e94ed90b1b, a0f09ff4c6b9, b0eca0edddf4. Distro kernels may backport; check your vendor's advisory.

## Timeline

- 2026-11-02T16:24:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99218
- 2026-11-02T16:30:37+00:00 analyst — NVD record (kernel.org CNA data, status Received) lists fixed stable releases and 6 fix commits; not verified against git.kernel.org pages, distro status unchecked. No exploitation or PoC found.

## Documents

- [advisory] NVD record CVE-2026-99218 (kernel.org CNA data) https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-99218

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

coredump: hold RCU while releasing parked threads

coredump_finish() releases the parked threads by clearing ->task in
their core_thread entry and calling wake_up_process() on each of them.
It does that without holding a reference on the task and without being
inside rcu.

But calling wake_up_process(task) without rcu here isn't safe. A parked
thread doesn't need that wakeup to leave. A spurious wakeup or a
preemption after the store is enough for the task to go away.

So if the coredump client is preempted between the store and
wake_up_process() the thread can exit and be freed in the meantime and
try_to_wake_up() takes pi_lock in freed memory.

Hold rcu across the loop.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_