Strix
74.1K

CVE-2026-99218

HIGHCVSS 7/10EPSS 0.12%

Last modified

CVE-2026-99218 is a high-severity vulnerability rated 7/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. EPSS estimates a 0.12% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory. Hold rcu across the loop.

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.12%

2.0th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= a94e2d408eaedbd85aae259621d46fafc10479a2, < fd0fbe84312fda2fc187428c92c50b7d03a9d24c; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < 71146c437bae59e5280f657965dc6d006ee3989b; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < 0fce73efee40c65ce26641c5d93942462f9e8307; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < 16e94ed90b1b02398e044d41fd1db34828daa08e; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573; >= a94e2d408eaedbd85aae259621d46fafc10479a2, < 61d58591aa0188bf2463e263962256316ff8b576
LinuxLinux2.6.27

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99218?
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory. Hold rcu across the loop.
How severe is CVE-2026-99218?
CVE-2026-99218 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.12% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99218?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99218?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST