In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish()…
CVE-2026-99218
In the Linux kernel, the following vulnerability has been resolved: coredump: hold RCU while releasing parked threads coredumpfinish() releases the parked threads by clearing ->task in their corethread entry and calling wakeupprocess() on each of them. It does that without holding a reference on the task and without being inside rcu. But calling wakeupprocess(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away. So if the coredump client is preempted between the store and wakeupprocess() the thread can exit and be freed in the meantime and trytowakeup() takes pilock in freed memory. Hold rcu across the loop.
Assessment
- CVSS
- 7 (v3.1)
- Severity
- High
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 2 November 2026
- Last updated
- 3 November 2026
- Assigner
- Linux
CVSS vectorCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
At the source
References
- https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c
- https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b
- https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307
- https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e
- https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c
- https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573
- https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-99218