CVE-2026-53352
Received Received - Intake

Race Condition in Linux Kernel Signal Handling

Publication date: 2026-07-01

Last updated on: 2026-07-01

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded process receives a stop signal (e.g., SIGSTOP), do_signal_stop() sets JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME on all threads and sets signal->group_stop_count to the number of threads. If one of the threads concurrently calls execve(), de_thread() invokes zap_other_threads() to kill all other threads. zap_other_threads() aborts the pending group stop by resetting signal->group_stop_count to 0 and clears the JOBCTL_PENDING_MASK for all other threads. However, it fails to clear the job control flags for the calling thread. When execve() completes, the calling thread returns to user mode and checks for pending signals. Seeing the stale JOBCTL_STOP_PENDING flag, it calls do_signal_stop(), which invokes task_participate_group_stop(). Since JOBCTL_STOP_CONSUME is still set, it attempts to decrement the already-zero signal->group_stop_count, triggering a warning: sig->group_stop_count == 0 WARNING: CPU: 1 PID: 6475 at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 Call Trace: <TASK> do_signal_stop+0x3be/0x5c0 kernel/signal.c:2619 get_signal+0xa8c/0x1330 kernel/signal.c:2884 arch_do_signal_or_restart+0xbc/0x840 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop+0x8c/0x4d0 kernel/entry/common.c:98 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> Fix this race condition by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads(), ensuring it does not retain any stale job control state after the thread group is destroyed. This aligns with other functions that tear down a thread group and abort group stops, such as zap_process() and complete_signal(), which correctly clear these flags for all threads including the current one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-01
Last Modified
2026-07-01
Generated
2026-07-01
AI Q&A
2026-07-01
EPSS Evaluated
N/A
NVD
CVE-2026-53352
EUVD
EUVD-2026-40986

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's handling of multi-threaded processes when they receive a stop signal such as SIGSTOP.

When a multi-threaded process is stopped, the kernel sets certain flags (JOBCTL_STOP_PENDING and JOBCTL_STOP_CONSUME) on all threads and tracks the number of threads stopped. If one thread calls execve() concurrently, the kernel tries to kill all other threads and abort the stop signal by clearing flags for other threads but fails to clear the job control flags for the calling thread.

As a result, the calling thread retains stale job control flags, which leads to a race condition. When execve() completes and the thread returns to user mode, it sees the stale flags and attempts to process the stop signal again, causing a warning and potential instability.

The fix involves clearing the JOBCTL_PENDING_MASK for the calling thread as well, ensuring no stale job control state remains after the thread group is destroyed.

Impact Analysis

This vulnerability can cause race conditions and warnings in the Linux kernel when handling multi-threaded processes that receive stop signals and concurrently execute new programs.

Such race conditions may lead to kernel instability or unexpected behavior in multi-threaded applications, potentially affecting system reliability and performance.

Detection Guidance

This vulnerability manifests as a kernel warning related to job control flags when a multi-threaded process receives a stop signal and concurrently calls execve(). Specifically, the warning message is:

  • WARNING: CPU: <cpu_id> PID: <pid> at kernel/signal.c:373 task_participate_group_stop+0x215/0x2d0 sig->group_stop_count == 0

To detect this issue on your system, you can monitor the kernel logs for this warning message using commands such as:

  • dmesg | grep 'sig->group_stop_count == 0'
  • journalctl -k | grep 'sig->group_stop_count == 0'

These commands will help identify if the kernel is logging the warning indicative of this race condition.

Mitigation Strategies

The vulnerability is a race condition in the Linux kernel's handling of job control flags in multi-threaded processes. Immediate mitigation steps include:

  • Update the Linux kernel to a version where this vulnerability is fixed, as the issue is resolved by clearing the JOBCTL_PENDING_MASK for the calling thread in zap_other_threads().
  • Avoid running untrusted or potentially vulnerable multi-threaded applications that may trigger this condition until the kernel is patched.
  • Monitor kernel logs for the warning message to detect if the issue is occurring.

Since this is a kernel-level race condition, patching the kernel is the definitive mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart