{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"18a3427526e2141f80050f82c1d26b19a454707d","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"378481cc60a937ef8ea4ef6e4f95f0dbc4e21414","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"f62a1f245a71680033260a6f6d74011cc3acb3cd","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"dc892cbb1e4341d427b1f940ebd6abd69bf8e479","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"a8874c34c4a973f9922908a4b8be1d1278f01e42","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"823886a1b089b49bcd349bc8bd3417b7910cd1ac","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"},{"lessThan":"6b4f48728faa8bb514368f7eacda05565dea8696","status":"affected","version":"91b8534fa8f5e01f249b1bf8df0a2540053549ad","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"2.6.28"},{"lessThan":"2.6.28","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.266","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.97","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.40","versionType":"semver"},{"lessThanOrEqual":"7.1.*","status":"unaffected","version":"7.1.5","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.2","versionType":"original_commit_for_fix"}]}],"cveId":"CVE-2026-72166","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/9p: fix infinite loop in p9_client_rpc on fatal signal\n\nWhen p9_client_rpc() is called with type P9_TFLUSH and the transport\nhas no peer (e.g. fd transport backed by pipes with no 9p server),\na fatal signal causes an infinite loop:\n\n  again:\n\terr = io_wait_event_killable(req->wq, ...)\n\t/* SIGKILL wakes the task, returns -ERESTARTSYS */\n\n\tif (err == -ERESTARTSYS && c->status == Connected &&\n\t\ttype == P9_TFLUSH) {\n\t\tsigpending = 1;\n\t\tclear_thread_flag(TIF_SIGPENDING);\n\t\tgoto again;\n\t}\n\nclear_thread_flag() clears TIF_SIGPENDING before jumping back to\nio_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING,\nfinds it zero, and the task goes to sleep again. The task can only wake\non the next signal delivery that calls signal_wake_up() and sets\nTIF_SIGPENDING again. When that happens the loop repeats, clears\nTIF_SIGPENDING, and sleeps again indefinitely.\n\nThis is triggered in practice by coredump_wait(): when a thread in a\nmulti-threaded process causes a coredump (e.g. via SIGSYS from Syscall\nUser Dispatch), coredump_wait() sends SIGKILL to all other threads and\nwaits for them to call mm_release(). If one of those threads is blocked\nin p9_client_rpc() over an fd transport with no peer, it enters the\nP9_TFLUSH loop and never calls mm_release(), so coredump_wait() stalls\nforever:\n\nINFO: task syz.0.18:676 blocked for more than 143 seconds.\n      Not tainted 6.12.77+ #1\ntask:syz.0.18 state:D stack:27600 pid:676 tgid:673 ppid:630 flags:0x00000004\nCall Trace:\n <TASK>\n context_switch kernel/sched/core.c:5344 [inline]\n __schedule+0xcb4/0x5d50 kernel/sched/core.c:6724\n __schedule_loop kernel/sched/core.c:6801 [inline]\n schedule+0xe5/0x350 kernel/sched/core.c:6816\n schedule_timeout+0x253/0x290 kernel/time/timer.c:2593\n do_wait_for_common kernel/sched/completion.c:95 [inline]\n __wait_for_common+0x409/0x600 kernel/sched/completion.c:116\n wait_for_common kernel/sched/completion.c:127 [inline]\n wait_for_completion_state+0x1d/0x40 kernel/sched/completion.c:264\n coredump_wait fs/coredump.c:448 [inline]\n do_coredump+0x854/0x4350 fs/coredump.c:629\n get_signal+0x1425/0x2730 kernel/signal.c:2903\n arch_do_signal_or_restart+0x81/0x880 arch/x86/kernel/signal.c:337\n exit_to_user_mode_loop kernel/entry/common.c:111 [inline]\n exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]\n syscall_exit_to_user_mode+0xf9/0x160 kernel/entry/common.c:218\n do_syscall_64+0x102/0x220 arch/x86/entry/common.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n </TASK>\n\nFix: check fatal_signal_pending() before clearing TIF_SIGPENDING in the\nP9_TFLUSH retry loop. At that point TIF_SIGPENDING is still set, so\nfatal_signal_pending() works correctly. If a fatal signal is pending,\njump to recalc_sigpending to restore TIF_SIGPENDING and return\n-ERESTARTSYS to the caller.\n\nThe same defect is present in stable kernels back to 5.4. On those\nkernels the infinite loop is broken earlier by a second SIGKILL from\nthe parent process (e.g. kill_and_wait() retrying after a timeout),\nresulting in a zombie process and a shutdown delay rather than a\npermanent D-state hang, but the underlying flaw is the same.\n\nFound by Linux Verification Center (linuxtesting.org) with Syzkaller.","epss":{"date":"2026-11-06","percentile":0.12127,"score":0.00216},"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793985578930,"publishedAt":1786773213383,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/18a3427526e2141f80050f82c1d26b19a454707d"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/378481cc60a937ef8ea4ef6e4f95f0dbc4e21414"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f62a1f245a71680033260a6f6d74011cc3acb3cd"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/dc892cbb1e4341d427b1f940ebd6abd69bf8e479"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/a8874c34c4a973f9922908a4b8be1d1278f01e42"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/823886a1b089b49bcd349bc8bd3417b7910cd1ac"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/6b4f48728faa8bb514368f7eacda05565dea8696"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/18a3427526e2141f80050f82c1d26b19a454707d"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/378481cc60a937ef8ea4ef6e4f95f0dbc4e21414"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/6b4f48728faa8bb514368f7eacda05565dea8696"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/823886a1b089b49bcd349bc8bd3417b7910cd1ac"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/a8874c34c4a973f9922908a4b8be1d1278f01e42"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/dc892cbb1e4341d427b1f940ebd6abd69bf8e479"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/f62a1f245a71680033260a6f6d74011cc3acb3cd"}],"remediation":[],"revision":"a27e4f7aef2fb8de6646b2b13da77650702f4af3e7ea280858e6fd5a20d6e23a","sources":[{"modifiedAt":1793984121704,"name":"CNA: Linux","retrievedAt":1793986058891,"url":"https://www.cve.org/CVERecord?id=CVE-2026-72166"},{"modifiedAt":1793985578930,"name":"NVD","retrievedAt":1793989694444,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72166"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793986076406,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-72166"}],"ssvc":{"assessedAt":1793983945738,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"net/9p: fix infinite loop in p9_client_rpc on fatal signal","updatedAt":1793989694444}