CVE-2026-99218

Last refreshed2026-11-02

Status: UPDATED | Advisory ID: CVE-2026-99218

Key Details

CVE	CVE-2026-99218
CVSS Score / Version	7.0 (High) / CVSS v3.1
Updated	2026-11-02
CVSS Vector	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is high; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

coredump: hold RCU while releasing parked threads

coredump_finish() releases the parked threads by clearing ->task in

their core_thread entry and calling wake_up_process() on each of them.

It does that without holding a reference on the task and without being

inside rcu.

But calling wake_up_process(task) without rcu here isn't safe. A parked

thread doesn't need that wakeup to leave. A spurious wakeup or a

preemption after the store is enough for the task to go away.

So if the coredump client is preempted between the store and

wake_up_process() the thread can exit and be freed in the meantime and

try_to_wake_up() takes pi_lock in freed memory.

Hold rcu across the loop. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-99218
CVE	https://www.cve.org/CVERecord?id=CVE-2026-99218

Source

Reference

NVD

CVE