Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

Skip to content
cve.newCreate a CVE report
Check your stack
CVE-2026-99249

pid_namespace: make zap_pid_ns_processes() freezable

Products / packages Linux

Published

Share

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 06/11/2026, 21:10:31 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

6 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before 064a6761d6f6ac55d090d3eaca649577ee736713

git versions

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before e8dafad7de9ede813af2d48cc04b7c88fef16682

git versions

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before 4b47107f1a80c809c80093e872bcaccdbae13db4

git versions

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before 2e10b8a74f55b5aae33db105d3e2d3ae759c865a

git versions

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before 7deb5770840339fe88755bf27b92f74edc26ee87

git versions

3eb07c8c8adb6f0572baba844ba2d9e501654316 → before 81933038f5e273d17ed22792f906889393b204c5

git versions

unaffected

unknown

Other versions: unaffected

Linux · Linux

Linux

8 ranges
Linux version evidence

Compare with this publisher’s ranges. This does not inspect your installation.

affected

2.6.24

unaffected

0 → before 2.6.24

semver versions

6.1.191 → through 6.1.*

semver versions

6.6.161 → through 6.6.*

semver versions

6.12.115 → through 6.12.*

semver versions

6.18.59 → through 6.18.*

semver versions

7.2.13 → through 7.2.*

semver versions

7.3 → through *

original_commit_for_fix versions

unknown

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

pid_namespace: make zap_pid_ns_processes() freezable

When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails:

Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0):

Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends.

Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does.

This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.

References

6 sources
git.kernel.org/stable/c/064a6761d6f6ac55d090d3eaca649577ee736713
Source referenceLinux
git.kernel.org/stable/c/e8dafad7de9ede813af2d48cc04b7c88fef16682
Source referenceLinux
git.kernel.org/stable/c/4b47107f1a80c809c80093e872bcaccdbae13db4
Source referenceLinux
git.kernel.org/stable/c/2e10b8a74f55b5aae33db105d3e2d3ae759c865a
Source referenceLinux
git.kernel.org/stable/c/7deb5770840339fe88755bf27b92f74edc26ee87
Source referenceLinux
git.kernel.org/stable/c/81933038f5e273d17ed22792f906889393b204c5
Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied
Version evidence
Remediation guidance · not supplied
Weakness classification · not supplied
Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-99249

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 6.1.191

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 6.6.161

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 6.12.115

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 6.18.59

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 7.2.13

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 2.6.24

Before: 7.3

Original applicability statements
[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "6.1.191"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "6.6.161"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "6.12.115"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "6.18.59"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "7.2.13"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "2.6.24",
            "versionEndExcluding": "7.3"
          }
        ]
      }
    ]
  }
]
Contributing organizations · 1
Linux

Assigning organization

2026-11-03

Timeline

All times UTC

  1. Advisory published

    Publication date supplied by the source.

  2. Last imported by cve.new

    Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes
No substantive changes have been recorded here yet. History starts when cve.new observes a change after tracking is enabled; earlier edits are not reconstructed.

Large field values are marked as truncated previews. Original source snapshots remain retained.