AZL-112532: CVE-2026-99218 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
coredump: hold RCU while releasing parked threads
coredumpfinish() releases the parked threads by clearing ->task in their corethread entry and calling wakeupprocess() on each of them. It does that without holding a reference on the task and without being inside rcu.
But calling wakeupprocess(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away.
So if the coredump client is preempted between the store and wakeupprocess() the thread can exit and be freed in the meantime and trytowakeup() takes pilock in freed memory.
Hold rcu across the loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Hold RCU across the loop in coredump_finish() while releasing parked threads, including when clearing each thread's ->task entry and calling wake_up_process().
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
The issue occurs during coredump handling when coredump_finish() releases parked threads. A race is possible if the coredump client is preempted after clearing a parked thread's task pointer but before calling wake_up_process(), allowing that thread to exit and be freed.
What is the consequence of a successful race?
The kernel can call try_to_wake_up() and take pi_lock in memory belonging to a freed task. The provided data does not specify a further impact such as privilege escalation, information disclosure, or denial of service.
How is the issue resolved?
The resolved change holds RCU across the loop that releases parked threads, so the task cannot be freed between clearing the task pointer and waking it.