Live › vulnerability › CVE-2026-99244
In the Linux kernel, the PID namespace reaper could be interrupted by a TIF_NOTIFY_SIGNAL flag that is raised again during livepatching, so it busy-waits instead of sleeping. The fix makes the reaper ignore that flag so it sleeps until a child exits.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 12:20 UTC. All times on this page are UTC.
The sources describe a Linux kernel PID namespace reaper that busy-waits when a livepatch raises TIF_NOTIFY_SIGNAL, which affects systems that run kernel livepatching and PID namespaces such as container hosts. The sources do not state which kernel versions are affected or whether an attacker can trigger it, so the exposure is unknown.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits.
But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes.
The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately.
Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.
This page as .md · .json · in your agent: get_signal("CVE-2026-99244")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.