Strix
74K

CVE-2026-99244

Unknown

Last modified

CVE-2026-99244 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits. But clearing TIF_NOTIFY_SIGNAL doesn't fix it.

Description

In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits. But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes. The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately. Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= edd2754a62bee8d97b4808a15de024f66a1ddccf, < 2c20ace1698d03a23467351be1d281e89b36ade3; >= 3466abafa9f4f81a869da828e52a12f693175ec2, < 9ab0324f4868eeb20c63f063a1e5bc01d5539212; >= 7fea700e04bd3f424c2d836e98425782f97b494e, < 30b274508c743f243c82904954c4e416d7143d4c; >= 7fea700e04bd3f424c2d836e98425782f97b494e, < 70178691c467c8f9f722765299fd8524c3121a35; >= 7fea700e04bd3f424c2d836e98425782f97b494e, < 3d15ac36ce174477efa5365e424dbd47950fd2b9; >= 7fea700e04bd3f424c2d836e98425782f97b494e, < f46cd8241d9b83f2279cc0db3e9d3e181b548a59; >= 7fea700e04bd3f424c2d836e98425782f97b494e, < 5c0985dd3c32fc2bbd0e8beaf13cf52cd97376a2; 82c7acf9a12c9b4e4b0aba531de82b4e39a345c8; 8e69e589f233ca2c9631f5af2b94f95dfc2ba804; 09ab5b424b17cfe633db58bb2f9edbaf9484cf20; >= 6.1.95, < 6.1.191; >= 6.6.35, < 6.6.161; >= 5.10.221, < 5.11; >= 5.15.162, < 5.16; >= 6.9.6, < 6.10
LinuxLinux6.10

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99244?
In the Linux kernel, the following vulnerability has been resolved: pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper Since commit 7fea700e04bd ("zap_pid_ns_processes: clear TIF_NOTIFY_SIGNAL along with TIF_SIGPENDING") zap_pid_ns_processes() clears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise kernel_wait4() doesn't sleep and returns -ERESTARTSYS if signal_pending() is true and the reaper busy-waits. But clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again. For example, klp_send_signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes. The sleep loop waiting for pid_allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK_INTERRUPTIBLE returns immediately. Use a no_notify_signal guard. signal_pending() will ignore TIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child exits or free_pid() wakes it.
How severe is CVE-2026-99244?
Severity scoring for CVE-2026-99244 is pending analysis.
How do I fix CVE-2026-99244?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99244?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST