{"id":"CVE-2026-99244","kind":"vulnerability","aliases":["CVE-2026-99244"],"related":[],"title":"Linux kernel: PID namespace reaper can busy-wait instead of sleeping","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn't sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn't\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn't even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it.","summary":"In the Linux kernel, the PID namespace reaper could be interrupted by a TIF_NOTIFY_SIGNAL flag that is raised again during livepatching, so it busy-waits instead of sleeping. The fix makes the reaper ignore that flag so it sleeps until a child exits.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","linux-kernel","livepatch","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","triaged_at":"2026-11-03T12:23:03+00:00","updated_at":"2026-11-03T12:23:03+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-03T12:23:03Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Linux kernel: PID namespace reaper can busy-wait instead of sleeping","impact":"low","summary":"In the Linux kernel, the PID namespace reaper could be interrupted by a TIF_NOTIFY_SIGNAL flag that is raised again during livepatching, so it busy-waits instead of sleeping. The fix makes the reaper ignore that flag so it sleeps until a child exits.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux-kernel","containers","livepatch"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown; source describes a busy-wait loop, not code execution","analyst_note":"Find the affected kernel version ranges and the fixing commit in the kernel stable tree or the NVD entry for CVE-2026-99244.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"The sources describe a Linux kernel PID namespace reaper that busy-waits when a livepatch raises TIF_NOTIFY_SIGNAL, which affects systems that run kernel livepatching and PID namespaces such as container hosts. The sources do not state which kernel versions are affected or whether an attacker can trigger it, so the exposure is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000708,"input_tokens":4479,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99244':15A,18A '7fea700e04bd':93C 'alloc':184C 'along':102C 'anyth':197C 'busi':8A,51B,137C 'busy-wait':7A,50B,136C 'call':118C 'child':69B,227C 'clear':98C,110C,140C,196C 'commit':92C 'contain':19B 'could':33B 'cve':13A,16A 'doesn':122C,144C,193C 'drop':186C 'erestartsi':127C 'even':195C 'everi':115C 'exampl':154C 'exit':70B,228C 'finish':177C 'fix':57B,146C 'flag':41B,63B 'follow':76C 'free':230C 'get':150C 'guard':211C 'hasn':165C 'ignor':61B,215C 'immedi':205C 'instead':10A,53B 'interrupt':35B,88C,203C 'keep':171C 'kernel':2A,22B,28B,74C,116C,120C 'klp':155C 'linux':1A,21B,27B,73C 'linux-kernel':20B 'livepatch':23B,47B,176C 'loop':180C 'make':58B 'namespac':4A,31B,82C,222C 'notifi':39B,85C,100C,112C,142C,209C,217C 'ns':96C,108C 'otherwis':119C 'pend':130C,213C 'pid':3A,30B,81C,95C,107C,183C,221C,231C 'prevent':83C 'problem':190C 'process':97C,109C 'rais':44B,151C 'raw':160C 'reaper':5A,32B,60B,90C,135C,223C 'resolv':80C 'return':126C,204C 'runtim':24B 'schedul':200C 'send':156C,172C 'set':158C 'signal':40B,86C,101C,113C,129C,143C,157C,210C,212C,218C 'sigpend':105C 'sinc':91C 'sleep':12A,55B,66B,124C,179C,224C 'task':163C,202C 'tif':38B,84C,99C,104C,111C,141C,216C 'transit':167C 'true':132C 'use':206C 'vulner':77C 'wait':9A,52B,138C,181C 'wait4':117C,121C 'wake':232C 'yet':168C 'zap':94C,106C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a Linux kernel PID namespace reaper that busy-waits when a livepatch raises TIF_NOTIFY_SIGNAL, which affects systems that run kernel livepatching and PID namespaces such as container hosts. The sources do not state which kernel versions are affected or whether an attacker can trigger it, so the exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containers","linuxkernel","livepatch","runtime","unknown"],"first_public_at":"2026-11-03T12:17:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99244","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99244","severity":null,"published_at":"2026-11-03T12:17:30+00:00","modified_at":"2026-11-03T12:17:30+00:00","first_seen_at":"2026-11-03T12:20:38+00:00","fetched_at":"2026-11-03T12:20:38+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}