UBUNTU-CVE-2026-99218: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish() releases the parked threads by clearing ->task in their corethread entry and calling wakeupprocess() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wakeupprocess(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wakeupprocess() the thread can exit and be freed in the meantime and trytowakeup() takes pilock in freed memory. Hold rcu across the loop.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In coredump_finish(), hold RCU across the loop that clears each parked thread's ->task entry and calls wake_up_process().
Event History
Frequently Asked Questions
Who can exploit this issue?
The vector is local and requires low privileges. Exploitation also requires high attack complexity; no user interaction is required.
What conditions trigger the unsafe access?
The issue occurs during coredump completion while parked threads are being released. A parked thread can exit after its task pointer is cleared but before wake_up_process() runs, allowing the wake-up path to access freed task memory.
Which Ubuntu kernel package families are listed as affected?
The listed software includes Ubuntu linux, linux-fips, linux-aws, linux-azure, linux-gcp, linux-oracle, linux-aws-fips, and linux-azure-fips.
What is the remediation described by the fix?
The fix holds RCU across the loop that releases parked threads, so the task cannot be freed while wake_up_process() is being called.