{"id":"CVE-2026-99249","kind":"vulnerability","aliases":["CVE-2026-99249"],"related":[],"title":"Linux kernel: suspend can hang while a pid namespace init waits","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: make zap_pid_ns_processes() freezable\n\nWhen the init of a pid namespace exits, zap_pid_ns_processes() waits\nuntil all other pids in the namespace are freed. A tracer outside the\nnamespace that does not reap its traced zombies keeps those pids\nallocated, so this wait has no upper bound, and while it lasts every\nsuspend attempt fails:\n\n  Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):\n\nNeither wait is freezable. The first loop sleeps in do_wait(), which\nreturns -ERESTARTSYS on the freezer's fake signal; the loop then clears\nTIF_SIGPENDING and waits again without ever freezing. The final loop\nsleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING\nthere, schedule() returns immediately after the first freeze attempt\nand the task spins until the wait ends.\n\nSleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the\nfreezer can freeze tasks waiting there directly, and in TASK_IDLE |\nTASK_FREEZABLE in the final loop, like coredump_task_exit() does.\n\nThis was hit with Chromium-based browsers: crashpad ptrace-attaches the\nthreads of a crashed renderer, which is a pid namespace init, and does\nnot reap those killed during the dump.","summary":"When the init process of a pid namespace exits, the kernel waits for the other processes in that namespace to finish, and that wait is not freezable. A tracer outside the namespace that never reaps its traced zombies can keep the wait going indefinitely, so suspend fails.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["containers","infrastructure","linux-kernel","suspend"],"not_affected_if":["no-pid-namespaces"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","triaged_at":"2026-11-03T12:22:58+00:00","updated_at":"2026-11-03T12:22:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-03T12:22:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: suspend can hang while a pid namespace init waits","impact":"low","summary":"When the init process of a pid namespace exits, the kernel waits for the other processes in that namespace to finish, and that wait is not freezable. A tracer outside the namespace that never reaps its traced zombies can keep the wait going indefinitely, so suspend fails.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","suspend","containers"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"system suspend hangs until the blocking wait ends","analyst_note":"Check the kernel stable commit for affected and fixed versions; the NVD entry provided no version ranges.","how_to_check":"unknown","plain_action":"","needs_analyst":true,"not_affected_if":["no-pid-namespaces"],"who_is_affected":"The sources describe a suspend or freeze failure on Linux systems where a process tracer outside a pid namespace does not reap its traced children, as seen with Chromium-based browsers' crash reporting. The sources do not state which kernel versions are affected or what the impact on data is. unknown beyond that.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000689,"input_tokens":4541,"output_tokens":470,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-99249':14A,17A '0':157C '2':150C '20.006':148C 'alloc':126C 'attach':265C 'attempt':140C,211C 'base':260C 'bound':133C 'browser':261C 'busi':156C 'chromium':259C 'chromium-bas':258C 'clear':181C,200C 'contain':18B 'coredump':250C 'crash':270C 'crashpad':262C 'cve':12A,15A 'direct':238C 'dump':286C 'end':219C 'erestartsi':171C 'ever':188C 'everi':138C 'exit':32B,96C,252C 'fail':70B,141C,146C 'fake':176C 'final':191C,247C 'finish':44B 'first':163C,209C 'follow':76C 'freed':110C 'freez':142C,154C,189C,210C,234C 'freezabl':50B,88C,161C,225C,244C 'freezer':174C,232C 'go':66B 'hang':5A 'hit':256C 'idl':242C 'immedi':206C 'indefinit':67B 'infrastructur':19B 'init':10A,26B,91C,277C 'interrupt':196C,223C 'keep':63B,123C 'kernel':2A,22B,34B,74C 'kill':283C 'last':137C 'like':249C 'linux':1A,21B,73C 'linux-kernel':20B 'loop':164C,179C,192C,248C 'make':83C 'namespac':9A,31B,42B,55B,82C,95C,108C,115C,276C 'neither':158C 'never':57B 'noth':199C 'ns':86C,99C 'outsid':53B,113C 'pid':8A,30B,81C,85C,94C,98C,105C,125C,275C 'process':27B,39B,87C,100C,145C 'ptrace':264C 'ptrace-attach':263C 'reap':58B,119C,281C 'refus':152C 'render':271C 'resolv':80C 'return':170C,205C 'schedul':204C 'second':149C 'signal':177C 'sigpend':183C,202C 'sinc':198C 'sleep':165C,193C,220C 'space':144C 'spin':215C 'suspend':3A,23B,69B,139C 'task':151C,195C,214C,222C,224C,235C,241C,243C,251C 'thread':267C 'tif':182C,201C 'trace':60B,121C 'tracer':52B,112C 'upper':132C 'user':143C 'vulner':77C 'wait':11A,35B,47B,65B,101C,129C,159C,168C,185C,218C,228C,236C 'without':187C 'wq':155C 'zap':84C,97C 'zombi':61B,122C","nicknames":[],"mitigations":[],"who_affected":"The sources describe a suspend or freeze failure on Linux systems where a process tracer outside a pid namespace does not reap its traced children, as seen with Chromium-based browsers' crash reporting. The sources do not state which kernel versions are affected or what the impact on data is. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["containers","infrastructure","linuxkernel","suspend","unknown"],"first_public_at":"2026-11-03T12:17:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99249","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99249","severity":null,"published_at":"2026-11-03T12:17:31+00:00","modified_at":"2026-11-03T12:17:31+00:00","first_seen_at":"2026-11-03T12:20:39+00:00","fetched_at":"2026-11-03T12:20:39+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}