CVE-2026-99244None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDI…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
In the Linux kernel, the following vulnerability has been resolved:
pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits.
But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes.
The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately.
Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.
Linux >= edd2754a62bee8d97b4808a15de024f66a1ddccf < 2c20ace1698d03a23467351be1d281e89b36ade3Linux >= 3466abafa9f4f81a869da828e52a12f693175ec2 < 9ab0324f4868eeb20c63f063a1e5bc01d5539212Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 30b274508c743f243c82904954c4e416d7143d4cLinux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 70178691c467c8f9f722765299fd8524c3121a35Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 3d15ac36ce174477efa5365e424dbd47950fd2b9Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < f46cd8241d9b83f2279cc0db3e9d3e181b548a59Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2Linux 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8Linux 8e69e589f233ca2c9631f5af2b94f95dfc2ba804Linux 09ab5b424b17cfe633db58bb2f9edbaf9484cf20Linux >= 6.1.95 < 6.1.191Linux >= 6.6.35 < 6.6.161Linux >= 5.10.221 < 5.11Linux >= 5.15.162 < 5.16Linux >= 6.9.6 < 6.10Linux 6.10Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses