CVE-2026-99249
Received Received - Intake

Freeze-Resistant PID Namespace Cleanup in Linux Kernel

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99249
EUVD
EUVD-2026-115779

Affected Vendors & Products

Showing 7 associated CPEs
Vendor Product Version / Range
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 3eb07c8c8adb6f0572baba844ba2d9e501654316
Linux Linux 2.6.24

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a deadlock when a process in a pid namespace exits. The zap_pid_ns_processes() function waits indefinitely for all pids in the namespace to be freed, but if a tracer outside the namespace does not clean up traced zombies, the wait never completes. This prevents system suspend attempts from succeeding because the freezer cannot freeze tasks stuck in this loop.

Detection Guidance

This vulnerability is specific to the Linux kernel and relates to pid namespace handling. Detection requires checking kernel logs for freeze failures or tasks refusing to freeze. Monitor system logs for messages like 'Freezing user space processes failed' or tasks stuck in uninterruptible sleep (D state). Use commands like 'dmesg | grep -i freeze' or 'ps aux | grep -E 'D|TASK_INTERRUPTIBLE'' to identify affected processes.

Impact Analysis

This vulnerability can cause system hangs during suspend or hibernation attempts, leading to unresponsive systems. It may also cause applications like Chromium-based browsers to crash or behave unexpectedly if they rely on pid namespace cleanup.

Mitigation Strategies

Apply the latest Linux kernel update that resolves this issue. If immediate patching is not possible, monitor and terminate processes that may trigger the issue, such as Chromium-based browsers or other applications using pid namespaces. Restrict ptrace usage to trusted processes to prevent unauthorized tracing of pid namespace init processes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99249. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...