Cloudanix VulnDB

CVE-2026-99249

None

CVSS

—

EPSS

0.2%

Published

Nov 3, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A kernel bug can prevent computers from entering sleep mode when certain process-tracing tools are active inside isolated process groups.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

A non-reaping tracer outside a PID namespace can cause zap_pid_ns_processes() to wait indefinitely without freezing, blocking kernel suspend attempts.

Why it matters to the business

Affected systems may be unable to enter suspend or hibernation states, potentially leading to increased power consumption or failure to meet operational requirements in environments relying on power management, especially those using Chromium-based browsers or containerized workloads.

How an attack unfolds

An attacker or misbehaving process such as crashpad in Chromium-based browsers attaches as a tracer to a PID namespace init process and fails to reap zombie processes, preventing the namespace from cleaning up and causing freeze operations to fail repeatedly.

How to fix it

Apply the upstream kernel patch making waits in zap_pid_ns_processes() use TASK_INTERRUPTIBLE | TASK_FREEZABLE and TASK_IDLE | TASK_FREEZABLE.

How to confirm the fix worked

Confirm kernel source or binary includes the freezable changes to do_wait and final loop in pid_namespace.c; test suspend after simulating traced namespace exit.

Typical attack path

  1. Identify or create a PID namespace with an init process
  2. Attach as external tracer without reaping zombies on exit
  3. Trigger namespace init exit
  4. Initiate system suspend to trigger indefinite freeze failure

How to detect it

Inspect kernel logs for messages about freezing user space processes failing after timeout with references to tasks refusing to freeze or pid namespace waits.

What your security team should do

  • Apply kernel updates containing the pid_namespace fix as soon as available from distributions
  • Monitor container and browser workloads for suspend failures
  • Review ptrace usage in debugging and crash-reporting components

The record

In the Linux kernel, the following vulnerability has been resolved: pid_namespace: make zap_pid_ns_processes() freezable When the init of a pid namespace exits, zap_pid_ns_processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails: Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq_busy=0): Neither wait is freezable. The first loop sleeps in do_wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF_SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK_INTERRUPTIBLE, and since nothing clears TIF_SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends. Sleep in TASK_INTERRUPTIBLE | TASK_FREEZABLE in do_wait(), so that the freezer can freeze tasks waiting there directly, and in TASK_IDLE | TASK_FREEZABLE in the final loop, like coredump_task_exit() does. This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.

Affected packages

Ecosystem Package Introduced Fixed