CVE-2026-97903
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption is wrong. __change_pid() only records a detached PID in post.pids when pid_has_task() is false for every PIDTYPE. If another task still uses the exiting task's PID as its process group or session ID, __unhash_process() removes the exiting task's PIDTYPE_PID link but leaves the PID out of post.pids. release_task() therefore holds no reference to it after dropping tasklist_lock. The other task can then remove the remaining PIDTYPE links. Its free_pids() call schedules delayed_put_pid(), and the RCU callback can free the PID before the first release_task() reaches proc_flush_pid(). An unprivileged reproducer races wait4(-1) against setsid() to trigger this ordering. Three of three fresh v7.2 KASAN boots reported: BUG: KASAN: slab-use-after-free in proc_invalidate_siblings_dcache+0x3e2/0x3f0 Read of size 8 by task h7_pid_reaper/1921 Call Trace: proc_invalidate_siblings_dcache release_task wait_consider_task __do_wait do_wait kernel_wait4 Freed by task 0: kmem_cache_free put_pid delayed_put_pid rcu_core Last potentially related work creation: __call_rcu_common free_pids ksys_setsid KASAN identified a 144-byte object from the pid cache and located the bad read 80 bytes into the freed object, matching pid->inodes. With an explicit reference, three of three fresh boots completed without a KASAN report. The concurrent RCU callback dropped its reference while proc_flush_pid() was protected, and the balancing put_pid() performed the final free afterward. Take a reference before __unhash_process() clears p->thread_pid and release it after proc_flush_pid() completes. A tested source reproducer is available privately on request. No controlled read or write, information leak, or privilege escalation is claimed. The mainline patch applies directly to v6.19.y and newer; v6.16.y through v6.18.y need a context-adjusted backport.
View original CVE JSON
{
"id": "CVE-2026-97903",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-09-25T11:17:17.150",
"lastModified": "2026-10-19T10:17:40.527",
"vulnStatus": "Received",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong. __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE. If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids. release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links. Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering. Three of three fresh v7.2 KASAN boots reported:\n\n BUG: KASAN: slab-use-after-free in\n proc_invalidate_siblings_dcache+0x3e2/0x3f0\n Read of size 8 by task h7_pid_reaper/1921\n\n Call Trace:\n proc_invalidate_siblings_dcache\n release_task\n wait_consider_task\n __do_wait\n do_wait\n kernel_wait4\n\n Freed by task 0:\n kmem_cache_free\n put_pid\n delayed_put_pid\n rcu_core\n\n Last potentially related work creation:\n __call_rcu_common\n free_pids\n ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes. With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport. The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request. No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed. The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"kernel/exit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
"lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
"versionType": "git",
"status": "affected"
},
{
"version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
"lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
"versionType": "git",
"status": "affected"
},
{
"version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
"lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"kernel/exit.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.16",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.16",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.53",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2.7",
"lessThanOrEqual": "7.2.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.3",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9
}
]
},
"references": [
{
"url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
]
}