CVE-2026-99249: pid_namespace: make zap_pid_ns_processes() freezable

In the Linux kernel, the following vulnerability has been resolved:

pidnamespace: make zappidnsprocesses() freezable

When the init of a pid namespace exits, zappidnsprocesses() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails:

Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wqbusy=0):

Neither wait is freezable. The first loop sleeps in dowait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIFSIGPENDING and waits again without ever freezing. The final loop sleeps in TASKINTERRUPTIBLE, and since nothing clears TIFSIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends.

Sleep in TASKINTERRUPTIBLE | TASKFREEZABLE in dowait(), so that the freezer can freeze tasks waiting there directly, and in TASKIDLE | TASKFREEZABLE in the final loop, like coredumptaskexit() does.

This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.