---
id: CVE-2026-99218
title: 'coredump: hold RCU while releasing parked threads'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  coredump: hold RCU while releasing parked threads

  coredump_finish() releases the parked threads by clearing ->task in
  their core_thread entry and calling wake_up_proce…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    fd0fbe84312fda2fc187428c92c50b7d03a9d24c
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    71146c437bae59e5280f657965dc6d006ee3989b
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    0fce73efee40c65ce26641c5d93942462f9e8307
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    16e94ed90b1b02398e044d41fd1db34828daa08e
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573
  - >-
    Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 <
    61d58591aa0188bf2463e263962256316ff8b576
  - Linux 2.6.27
published: '2026-11-02'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:12:53.426Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99218'
references:
  - url: 'https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c'
  - url: 'https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b'
  - url: 'https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307'
  - url: 'https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e'
  - url: 'https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c'
  - url: 'https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573'
  - url: 'https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.02
ingestedAt: '2026-11-05T20:33:06.379Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

coredump: hold RCU while releasing parked threads

coredump_finish() releases the parked threads by clearing ->task in
their core_thread entry and calling wake_up_process() on each of them.
It does that without holding a reference on the task and without being
inside rcu.

But calling wake_up_process(task) without rcu here isn't safe. A parked
thread doesn't need that wakeup to leave. A spurious wakeup or a
preemption after the store is enough for the task to go away.

So if the coredump client is preempted between the store and
wake_up_process() the thread can exit and be freed in the meantime and
try_to_wake_up() takes pi_lock in freed memory.

Hold rcu across the loop.

## Affected

- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < fd0fbe84312fda2fc187428c92c50b7d03a9d24c`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < 71146c437bae59e5280f657965dc6d006ee3989b`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < 0fce73efee40c65ce26641c5d93942462f9e8307`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < 16e94ed90b1b02398e044d41fd1db34828daa08e`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573`
- `Linux >= a94e2d408eaedbd85aae259621d46fafc10479a2 < 61d58591aa0188bf2463e263962256316ff8b576`
- `Linux 2.6.27`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.