CVE-2026-99244
Received Received - Intake

Linux Kernel PID Namespace Signal Handling Flaw

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits. But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes. The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately. Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99244
EUVD
EUVD-2026-115774

Affected Vendors & Products

Showing 15 associated CPEs
Vendor Product Version / Range
Linux Linux edd2754a62bee8d97b4808a15de024f66a1ddccf
Linux Linux 3466abafa9f4f81a869da828e52a12f693175ec2
Linux Linux 7fea700e04bd3f424c2d836e98425782f97b494e
Linux Linux 7fea700e04bd3f424c2d836e98425782f97b494e
Linux Linux 7fea700e04bd3f424c2d836e98425782f97b494e
Linux Linux 7fea700e04bd3f424c2d836e98425782f97b494e
Linux Linux 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8
Linux Linux 8e69e589f233ca2c9631f5af2b94f95dfc2ba804
Linux Linux 09ab5b424b17cfe633db58bb2f9edbaf9484cf20
Linux Linux 6.1.95
Linux Linux 6.6.35
Linux Linux 5.10.221
Linux Linux 5.15.162
Linux Linux 6.9.6
Linux Linux 6.10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition where TIF_NOTIFY_SIGNAL interrupts the pid namespace reaper process. The reaper, which waits for child processes to exit, may not sleep properly due to signals being raised repeatedly, causing it to busy-wait instead of sleeping until a child exits or is freed.

Detection Guidance

This vulnerability is specific to the Linux kernel and requires checking kernel version and configuration. Use uname -a to check kernel version and grep for TIF_NOTIFY_SIGNAL in kernel source or logs.

Impact Analysis

This could lead to excessive CPU usage as the reaper process remains active in a busy-wait loop instead of sleeping. It may also cause delays in process cleanup and resource management within pid namespaces, potentially affecting system performance and stability.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch this issue. Monitor kernel logs for TIF_NOTIFY_SIGNAL related errors and ensure no livepatch operations are pending.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99244. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...