Linux Kernel PID Namespace Freezer Deadlock
CVE-2026-99249 Published on November 3, 2026
pid_namespace: make zap_pid_ns_processes() freezable
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: make zap_pid_ns_processes() freezable
When the init of a pid namespace exits, zap_pid_ns_processes() waits
until all other pids in the namespace are freed. A tracer outside the
namespace that does not reap its traced zombies keeps those pids
allocated, so this wait has no upper bound, and while it lasts every
suspend attempt fails:
Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):
Neither wait is freezable. The first loop sleeps in do_wait(), which
returns -ERESTARTSYS on the freezer's fake signal; the loop then clears
TIF_SIGPENDING and waits again without ever freezing. The final loop
sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING
there, schedule() returns immediately after the first freeze attempt
and the task spins until the wait ends.
Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the
freezer can freeze tasks waiting there directly, and in TASK_IDLE |
TASK_FREEZABLE in the final loop, like coredump_task_exit() does.
This was hit with Chromium-based browsers: crashpad ptrace-attaches the
threads of a crashed renderer, which is a pid namespace init, and does
not reap those killed during the dump.
Products Associated with CVE-2026-99249
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below 064a6761d6f6ac55d090d3eaca649577ee736713 is affected.
- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below e8dafad7de9ede813af2d48cc04b7c88fef16682 is affected.
- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below 4b47107f1a80c809c80093e872bcaccdbae13db4 is affected.
- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below 2e10b8a74f55b5aae33db105d3e2d3ae759c865a is affected.
- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below 7deb5770840339fe88755bf27b92f74edc26ee87 is affected.
- Version 3eb07c8c8adb6f0572baba844ba2d9e501654316 and below 81933038f5e273d17ed22792f906889393b204c5 is affected.
- Version 2.6.24 is affected.
- Before 2.6.24 is unaffected.
- Version 6.1.191, <= 6.1.* is unaffected.
- Version 6.6.161, <= 6.6.* is unaffected.
- Version 6.12.115, <= 6.12.* is unaffected.
- Version 6.18.59, <= 6.18.* is unaffected.
- Version 7.2.13, <= 7.2.* is unaffected.
- Version 7.3, <= * is unaffected.