Exploitation evidence
Not listed in the latest downloaded CISA KEV catalog. This does not establish an absence of exploitation.
KEV checked 13 Nov 2026, 00:20 Jerusalem · Original catalog ↗Reported products and versions
Linux / Linux
Default status: unaffected
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < fd0fbe84312fda2fc187428c92c50b7d03a9d24c (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 71146c437bae59e5280f657965dc6d006ee3989b (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 0fce73efee40c65ce26641c5d93942462f9e8307 (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 16e94ed90b1b02398e044d41fd1db34828daa08e (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573 (git)
- affected: a94e2d408eaedbd85aae259621d46fafc10479a2 to < 61d58591aa0188bf2463e263962256316ff8b576 (git)
Linux / Linux
Default status: affected
- affected: 2.6.27
- unaffected: 0 to < 2.6.27 (semver)
- unaffected: 6.1.191 to ≤ 6.1.* (semver)
- unaffected: 6.6.161 to ≤ 6.6.* (semver)
- unaffected: 6.12.115 to ≤ 6.12.* (semver)
- unaffected: 6.18.60 to ≤ 6.18.* (semver)
- unaffected: 7.2.14 to ≤ 7.2.* (semver)
- unaffected: 7.3.1 to ≤ 7.3.* (semver)
- unaffected: 7.4-rc1 to ≤ * (original_commit_for_fix)
Fixes and workarounds
No explicit solution text in the downloaded CVE record. Consult the vendor advisory; unaffected version ranges are shown above as reported, not inferred as a patch recommendation.
Sources and related reporting
CVE Program record ↗ · Download tracked evidence as JSON
- https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c
- https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b
- https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307
- https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e
- https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c
- https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573
- https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576
Monitored source mentions
Shared CVE identifiers link source mentions; they do not establish that the reports describe the same incident.
Observed change timeline
History begins when Egret first downloads each source. It is not the complete upstream CVE history.
12 Nov 2026, 18:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-12",
"epss": 0.00122,
"percentile": 0.02016
}11 Nov 2026, 12:20 Jerusalem · EPSS observation updated
Stored EPSS snapshot at this observation.
{
"date": "2026-11-10",
"epss": 0.00122,
"percentile": 0.02002
}11 Nov 2026, 12:20 Jerusalem · CVE Program record changed
Stored CNA snapshot at this observation.
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"fs/coredump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "fd0fbe84312fda2fc187428c92c50b7d03a9d24c",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "71146c437bae59e5280f657965dc6d006ee3989b",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "0fce73efee40c65ce26641c5d93942462f9e8307",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "16e94ed90b1b02398e044d41fd1db34828daa08e",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
},
{
"lessThan": "61d58591aa0188bf2463e263962256316ff8b576",
"status": "affected",
"version": "a94e2d408eaedbd85aae259621d46fafc10479a2",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"fs/coredump.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.27"
},
{
"lessThan": "2.6.27",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.191",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.161",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.115",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.60",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.2.*",
"status": "unaffected",
"version": "7.2.14",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.3.*",
"status": "unaffected",
"version": "7.3.1",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.4-rc1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.191",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.161",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.115",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.60",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2.14",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.3.1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.4-rc1",
"versionStartIncluding": "2.6.27",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The UAF is in coredump_finish(), reached when a local dump signal is delivered via get_signal() -> vfs_coredump() -> do_coredump()/coredump_cleanup(). abort(), a user page-fault SIGSEGV, or tgkill() on the attacker's own thread group starts that path; no remote protocol supplies the curr->task pointer later handed to wake_up_process().\nAC:H - coredump_wait() parks siblings in coredump_task_exit() in TASK_IDLE (no TASK_WAKEKILL), so kill/tgkill cannot wake them. The UAF needs the dumper preempted between curr->task=NULL and wake_up_process() long enough for a spurious or freezer wakeup, full do_exit(), and an RCU GP via delayed_put_task_struct() — timing the attacker cannot force.\nPR:L - get_signal() dumps the caller's own dumpable thread group with no capability check. An ordinary user pthread_create()s a sibling and abort()s or faults into vfs_coredump(); coredump_skip() only bails on TASK_DUMPABLE_OFF, which a normal user process is not.\nUI:N - The attacker creates the extra thread and delivers the dump signal inside their own process; no other user must mount media, open a file, or otherwise act.\nS:U - try_to_wake_up() on the freed task_struct corrupts host kernel scheduler state inside the same kernel; this is ordinary in-kernel UAF impact, not a VM, IOMMU, or sandbox escape.\nC:H - wake_up_process() -> try_to_wake_up() reads __state, on_rq, and sched_class from the task_struct after delayed_put_task_struct() has freed it; a sprayable slab UAF read is High confidentiality per UAF guidance.\nI:H - try_to_wake_up() takes raw_spin_lock on the freed p->pi_lock, writes __state, and calls p->sched_class->enqueue_task(); reclaiming the task_struct slab yields a write and control-flow primitive.\nA:H - Taking pi_lock in memory already freed by delayed_put_task_struct(), as the fix describes, oopses or panics even without a successful spray, so availability is High."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T19:12:53.426Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c"
},
{
"url": "https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b"
},
{
"url": "https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307"
},
{
"url": "https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e"
},
{
"url": "https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c"
},
{
"url": "https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573"
},
{
"url": "https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"
}
],
"title": "coredump: hold RCU while releasing parked threads",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-99218",
"datePublished": "2026-11-02T16:06:31.088Z",
"dateReserved": "2026-09-25T10:25:14.401Z",
"dateUpdated": "2026-11-03T19:12:53.426Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}