RCU Freed Task Leak in Linux Kernel coredump core_thread
CVE-2026-99218 Published on November 2, 2026
coredump: hold RCU while releasing parked threads
In the Linux kernel, the following vulnerability has been resolved:
coredump: hold RCU while releasing parked threads
coredump_finish() releases the parked threads by clearing ->task in
their core_thread entry and calling wake_up_process() on each of them.
It does that without holding a reference on the task and without being
inside rcu.
But calling wake_up_process(task) without rcu here isn't safe. A parked
thread doesn't need that wakeup to leave. A spurious wakeup or a
preemption after the store is enough for the task to go away.
So if the coredump client is preempted between the store and
wake_up_process() the thread can exit and be freed in the meantime and
try_to_wake_up() takes pi_lock in freed memory.
Hold rcu across the loop.
Products Associated with CVE-2026-99218
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below fd0fbe84312fda2fc187428c92c50b7d03a9d24c is affected.
- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below 71146c437bae59e5280f657965dc6d006ee3989b is affected.
- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below 0fce73efee40c65ce26641c5d93942462f9e8307 is affected.
- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below 16e94ed90b1b02398e044d41fd1db34828daa08e is affected.
- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c is affected.
- Version a94e2d408eaedbd85aae259621d46fafc10479a2 and below b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573 is affected.
- Version 2.6.27 is affected.
- Before 2.6.27 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.60, <= 6.18.* is unaffected.
- Version 7.2.14, <= 7.2.* is unaffected.
- Version 7.3.1, <= 7.3.* is unaffected.