AZL-112604: CVE-2026-99249 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
pidnamespace: make zappidnsprocesses() freezable
When the init of a pid namespace exits, zappidnsprocesses() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails:
Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wqbusy=0):
Neither wait is freezable. The first loop sleeps in dowait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIFSIGPENDING and waits again without ever freezing. The final loop sleeps in TASKINTERRUPTIBLE, and since nothing clears TIFSIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends.
Sleep in TASKINTERRUPTIBLE | TASKFREEZABLE in dowait(), so that the freezer can freeze tasks waiting there directly, and in TASKIDLE | TASKFREEZABLE in the final loop, like coredumptaskexit() does.
This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to the suspend failure condition?
Systems are exposed when the init process of a PID namespace exits while a tracer outside that namespace retains traced zombie processes instead of reaping them. The issue was observed with Chromium-based browsers using crashpad to ptrace-attach to threads of a crashing process.
What is the operational impact while the affected wait is blocked?
The wait for processes in the PID namespace can have no upper bound. During that time, suspend attempts can fail because the waiting tasks do not freeze correctly; one of the affected waits can also spin after a freeze attempt.