---
id: CVE-2026-99244
title: 'pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper

  Since commit 7fea700e04bd ("zap_pid_ns_processes: clear
  TIF_NOTIFY_SIGNAL along with TIF_SIGPENDI…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= edd2754a62bee8d97b4808a15de024f66a1ddccf <
    2c20ace1698d03a23467351be1d281e89b36ade3
  - >-
    Linux >= 3466abafa9f4f81a869da828e52a12f693175ec2 <
    9ab0324f4868eeb20c63f063a1e5bc01d5539212
  - >-
    Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e <
    30b274508c743f243c82904954c4e416d7143d4c
  - >-
    Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e <
    70178691c467c8f9f722765299fd8524c3121a35
  - >-
    Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e <
    3d15ac36ce174477efa5365e424dbd47950fd2b9
  - >-
    Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e <
    f46cd8241d9b83f2279cc0db3e9d3e181b548a59
  - >-
    Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e <
    5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2
  - Linux 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8
  - Linux 8e69e589f233ca2c9631f5af2b94f95dfc2ba804
  - Linux 09ab5b424b17cfe633db58bb2f9edbaf9484cf20
  - Linux >= 6.1.95 < 6.1.191
  - Linux >= 6.6.35 < 6.6.161
  - Linux >= 5.10.221 < 5.11
  - Linux >= 5.15.162 < 5.16
  - Linux >= 6.9.6 < 6.10
  - Linux 6.10
published: '2026-11-03'
updated: '2026-11-03'
sourceUpdated: '2026-11-03T19:13:09.510Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99244'
references:
  - url: 'https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3'
  - url: 'https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212'
  - url: 'https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c'
  - url: 'https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35'
  - url: 'https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9'
  - url: 'https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59'
  - url: 'https://git.kernel.org/stable/c/5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2'
tags:
  - cve.org
epss: 0.00197
epssPercentile: 0.09466
ingestedAt: '2026-11-05T20:33:06.392Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper

Since commit 7fea700e04bd ("zap_pid_ns_processes: clear
TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes()
clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise
kernel_wait4() doesn't sleep and returns -ERESTARTSYS if
signal_pending() is true and the reaper busy-waits.

But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.
For example, klp_send_signals() sets it raw against any task that hasn't
transitioned yet. And it keeps sending it until the livepatch finishes.

The sleep loop waiting for pid_allocated to drop has the same problem
and it doesn't even clear anything. So a schedule() in
TASK_INTERRUPTIBLE returns immediately.

Use a no_notify_signal guard. signal_pending() will ignore
TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child
exits or free_pid() wakes it.

## Affected

- `Linux >= edd2754a62bee8d97b4808a15de024f66a1ddccf < 2c20ace1698d03a23467351be1d281e89b36ade3`
- `Linux >= 3466abafa9f4f81a869da828e52a12f693175ec2 < 9ab0324f4868eeb20c63f063a1e5bc01d5539212`
- `Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 30b274508c743f243c82904954c4e416d7143d4c`
- `Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 70178691c467c8f9f722765299fd8524c3121a35`
- `Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 3d15ac36ce174477efa5365e424dbd47950fd2b9`
- `Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < f46cd8241d9b83f2279cc0db3e9d3e181b548a59`
- `Linux >= 7fea700e04bd3f424c2d836e98425782f97b494e < 5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2`
- `Linux 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8`
- `Linux 8e69e589f233ca2c9631f5af2b94f95dfc2ba804`
- `Linux 09ab5b424b17cfe633db58bb2f9edbaf9484cf20`
- `Linux >= 6.1.95 < 6.1.191`
- `Linux >= 6.6.35 < 6.6.161`
- `Linux >= 5.10.221 < 5.11`
- `Linux >= 5.15.162 < 5.16`
- `Linux >= 6.9.6 < 6.10`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.