CVE-2026-99218

What it actually does

A race condition in coredump_finish allows a parked thread's task_struct to be freed between clearing its core_thread entry and calling wake_up_process, enabling use-after-free access to pi_lock in freed memory during try_to_wake_up.

Why it matters to the business

Local attackers with the ability to trigger core dumps can achieve kernel memory corruption leading to privilege escalation or system instability on affected Linux systems; the issue affects core kernel functionality so all distributions using the vulnerable code path require prompt updates.

How an attack unfolds

An attacker triggers a coredump that parks threads, then relies on preemption or a spurious wakeup to allow a parked thread to exit and free its task_struct before wake_up_process executes, causing the subsequent lock operation to touch freed memory.

How to fix it

Apply the upstream kernel patch that wraps the parked-thread release loop with rcu_read_lock and rcu_read_unlock; rebuild and deploy updated kernels for all affected distributions as soon as vendor packages become available.

How to confirm the fix worked

Confirm the fix by inspecting the coredump_finish function for the presence of rcu_read_lock/rcu_read_unlock around the loop that clears task pointers and calls wake_up_process; recompile with CONFIG_LOCKDEP and exercise core-dump paths to verify absence of use-after-free reports.

Typical attack path

1. Trigger a coredump for a multithreaded process to enter coredump_finish
2. Force preemption between the store clearing the task pointer and the wake_up_process call
3. Allow the parked thread to exit and free its task_struct
4. Execute try_to_wake_up on the now-freed memory to corrupt kernel state

How to detect it

Examine kernel logs for oops or use-after-free warnings referencing try_to_wake_up or pi_lock during coredump handling; correlate with processes that recently generated core files.

What your security team should do

• Prioritize kernel updates on all production Linux systems within the next maintenance window given the one-day-old disclosure
• Restrict unprivileged core-dump generation via sysctl until patches are deployed where feasible
• Monitor kernel mailing lists and distribution security feeds for backported fixes