{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-99244","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-09-25T10:25:14.403Z","datePublished":"2026-11-03T11:15:14.715Z","dateUpdated":"2026-11-03T19:13:09.510Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-11-03T19:13:09.510Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn't sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn't\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn't even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it."}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/pid_namespace.c"],"versions":[{"version":"edd2754a62bee8d97b4808a15de024f66a1ddccf","lessThan":"2c20ace1698d03a23467351be1d281e89b36ade3","status":"affected","versionType":"git"},{"version":"3466abafa9f4f81a869da828e52a12f693175ec2","lessThan":"9ab0324f4868eeb20c63f063a1e5bc01d5539212","status":"affected","versionType":"git"},{"version":"7fea700e04bd3f424c2d836e98425782f97b494e","lessThan":"30b274508c743f243c82904954c4e416d7143d4c","status":"affected","versionType":"git"},{"version":"7fea700e04bd3f424c2d836e98425782f97b494e","lessThan":"70178691c467c8f9f722765299fd8524c3121a35","status":"affected","versionType":"git"},{"version":"7fea700e04bd3f424c2d836e98425782f97b494e","lessThan":"3d15ac36ce174477efa5365e424dbd47950fd2b9","status":"affected","versionType":"git"},{"version":"7fea700e04bd3f424c2d836e98425782f97b494e","lessThan":"f46cd8241d9b83f2279cc0db3e9d3e181b548a59","status":"affected","versionType":"git"},{"version":"7fea700e04bd3f424c2d836e98425782f97b494e","lessThan":"5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2","status":"affected","versionType":"git"},{"version":"82c7acf9a12c9b4e4b0aba531de82b4e39a345c8","status":"affected","versionType":"git"},{"version":"8e69e589f233ca2c9631f5af2b94f95dfc2ba804","status":"affected","versionType":"git"},{"version":"09ab5b424b17cfe633db58bb2f9edbaf9484cf20","status":"affected","versionType":"git"},{"version":"6.1.95","lessThan":"6.1.191","status":"affected","versionType":"semver"},{"version":"6.6.35","lessThan":"6.6.161","status":"affected","versionType":"semver"},{"version":"5.10.221","lessThan":"5.11","status":"affected","versionType":"semver"},{"version":"5.15.162","lessThan":"5.16","status":"affected","versionType":"semver"},{"version":"6.9.6","lessThan":"6.10","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["kernel/pid_namespace.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.1.191","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.161","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.115","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.60","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.14","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3.1","lessThanOrEqual":"7.3.*","status":"unaffected","versionType":"semver"},{"version":"7.4-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.95","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.35","versionEndExcluding":"6.6.161"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.12.115"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.18.60"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"7.2.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"7.3.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"7.4-rc1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.221"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15.162"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.9.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3"},{"url":"https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212"},{"url":"https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c"},{"url":"https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35"},{"url":"https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9"},{"url":"https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59"},{"url":"https://git.kernel.org/stable/c/5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2"}],"title":"pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper","x_generator":{"engine":"bippy-1.2.0"}}}}