{"affected":[{"defaultStatus":"unaffected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"lessThan":"2c20ace1698d03a23467351be1d281e89b36ade3","status":"affected","version":"edd2754a62bee8d97b4808a15de024f66a1ddccf","versionType":"git"},{"lessThan":"9ab0324f4868eeb20c63f063a1e5bc01d5539212","status":"affected","version":"3466abafa9f4f81a869da828e52a12f693175ec2","versionType":"git"},{"lessThan":"30b274508c743f243c82904954c4e416d7143d4c","status":"affected","version":"7fea700e04bd3f424c2d836e98425782f97b494e","versionType":"git"},{"lessThan":"70178691c467c8f9f722765299fd8524c3121a35","status":"affected","version":"7fea700e04bd3f424c2d836e98425782f97b494e","versionType":"git"},{"lessThan":"3d15ac36ce174477efa5365e424dbd47950fd2b9","status":"affected","version":"7fea700e04bd3f424c2d836e98425782f97b494e","versionType":"git"},{"lessThan":"f46cd8241d9b83f2279cc0db3e9d3e181b548a59","status":"affected","version":"7fea700e04bd3f424c2d836e98425782f97b494e","versionType":"git"},{"status":"affected","version":"82c7acf9a12c9b4e4b0aba531de82b4e39a345c8","versionType":"git"},{"status":"affected","version":"8e69e589f233ca2c9631f5af2b94f95dfc2ba804","versionType":"git"},{"status":"affected","version":"09ab5b424b17cfe633db58bb2f9edbaf9484cf20","versionType":"git"},{"lessThan":"6.1.191","status":"affected","version":"6.1.95","versionType":"semver"},{"lessThan":"6.6.161","status":"affected","version":"6.6.35","versionType":"semver"},{"lessThan":"5.11","status":"affected","version":"5.10.221","versionType":"semver"},{"lessThan":"5.16","status":"affected","version":"5.15.162","versionType":"semver"},{"lessThan":"6.10","status":"affected","version":"6.9.6","versionType":"semver"}]},{"defaultStatus":"affected","product":"Linux","source":"CNA: Linux","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"}]}],"cveId":"CVE-2026-99244","cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\npid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper\n\nSince commit 7fea700e04bd (\"zap_pid_ns_processes: clear\nTIF_NOTIFY_SIGNAL along with TIF_SIGPENDING\") zap_pid_ns_processes()\nclears TIF_NOTIFY_SIGNAL before every kernel_wait4() call. Otherwise\nkernel_wait4() doesn't sleep and returns -ERESTARTSYS if\nsignal_pending() is true and the reaper busy-waits.\n\nBut clearing TIF_NOTIFY_SIGNAL doesn't fix it. It can get raised again.\nFor example, klp_send_signals() sets it raw against any task that hasn't\ntransitioned yet. And it keeps sending it until the livepatch finishes.\n\nThe sleep loop waiting for pid_allocated to drop has the same problem\nand it doesn't even clear anything. So a schedule() in\nTASK_INTERRUPTIBLE returns immediately.\n\nUse a no_notify_signal guard. signal_pending() will ignore\nTIF_NOTIFY_SIGNAL and the pid namespace reaper sleeps until a child\nexits or free_pid() wakes it.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793704543093,"publishedAt":1793704514715,"references":[{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/2c20ace1698d03a23467351be1d281e89b36ade3"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/9ab0324f4868eeb20c63f063a1e5bc01d5539212"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/30b274508c743f243c82904954c4e416d7143d4c"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/70178691c467c8f9f722765299fd8524c3121a35"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/3d15ac36ce174477efa5365e424dbd47950fd2b9"},{"source":"CNA: Linux","tags":[],"url":"https://git.kernel.org/stable/c/f46cd8241d9b83f2279cc0db3e9d3e181b548a59"}],"remediation":[],"revision":"5467867fbfcca07e16ca582d11a8da48de5c3dfee887ab980f715c1dda236838","sources":[{"modifiedAt":1793704543093,"name":"CNA: Linux","retrievedAt":1793707719483,"url":"https://www.cve.org/CVERecord?id=CVE-2026-99244"}],"ssvc":null,"status":"published","title":"pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper","updatedAt":1793707719483}