{"history":[{"alert":0,"cve":"CVE-2026-99218","id":23528,"kind":"epss","observed_at":1794500401,"payload":"{\"date\": \"2026-11-12\", \"epss\": 0.00122, \"percentile\": 0.02016}"},{"alert":0,"cve":"CVE-2026-99218","id":21133,"kind":"epss","observed_at":1794392402,"payload":"{\"date\": \"2026-11-10\", \"epss\": 0.00122, \"percentile\": 0.02002}"},{"alert":1,"cve":"CVE-2026-99218","id":20992,"kind":"cna","observed_at":1794392402,"payload":"{\"containers\": {\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Linux\", \"programFiles\": [\"fs/coredump.c\"], \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"versions\": [{\"lessThan\": \"fd0fbe84312fda2fc187428c92c50b7d03a9d24c\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"71146c437bae59e5280f657965dc6d006ee3989b\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"0fce73efee40c65ce26641c5d93942462f9e8307\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"16e94ed90b1b02398e044d41fd1db34828daa08e\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}, {\"lessThan\": \"61d58591aa0188bf2463e263962256316ff8b576\", \"status\": \"affected\", \"version\": \"a94e2d408eaedbd85aae259621d46fafc10479a2\", \"versionType\": \"git\"}]}, {\"defaultStatus\": \"affected\", \"product\": \"Linux\", \"programFiles\": [\"fs/coredump.c\"], \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.27\"}, {\"lessThan\": \"2.6.27\", \"status\": \"unaffected\", \"version\": \"0\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.1.*\", \"status\": \"unaffected\", \"version\": \"6.1.191\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.6.*\", \"status\": \"unaffected\", \"version\": \"6.6.161\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.12.*\", \"status\": \"unaffected\", \"version\": \"6.12.115\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"6.18.*\", \"status\": \"unaffected\", \"version\": \"6.18.60\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.2.*\", \"status\": \"unaffected\", \"version\": \"7.2.14\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"7.3.*\", \"status\": \"unaffected\", \"version\": \"7.3.1\", \"versionType\": \"semver\"}, {\"lessThanOrEqual\": \"*\", \"status\": \"unaffected\", \"version\": \"7.4-rc1\", \"versionType\": \"original_commit_for_fix\"}]}], \"cpeApplicability\": [{\"nodes\": [{\"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.1.191\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.6.161\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.12.115\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.18.60\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.2.14\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.3.1\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"7.4-rc1\", \"versionStartIncluding\": \"2.6.27\", \"vulnerable\": true}], \"negate\": false, \"operator\": \"OR\"}]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\ncoredump: hold RCU while releasing parked threads\\n\\ncoredump_finish() releases the parked threads by clearing ->task in\\ntheir core_thread entry and calling wake_up_process() on each of them.\\nIt does that without holding a reference on the task and without being\\ninside rcu.\\n\\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\\nthread doesn't need that wakeup to leave. A spurious wakeup or a\\npreemption after the store is enough for the task to go away.\\n\\nSo if the coredump client is preempted between the store and\\nwake_up_process() the thread can exit and be freed in the meantime and\\ntry_to_wake_up() takes pi_lock in freed memory.\\n\\nHold rcu across the loop.\"}], \"metrics\": [{\"cvssV3_1\": {\"baseScore\": 7, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - The UAF is in coredump_finish(), reached when a local dump signal is delivered via get_signal() -> vfs_coredump() -> do_coredump()/coredump_cleanup(). abort(), a user page-fault SIGSEGV, or tgkill() on the attacker's own thread group starts that path; no remote protocol supplies the curr->task pointer later handed to wake_up_process().\\nAC:H - coredump_wait() parks siblings in coredump_task_exit() in TASK_IDLE (no TASK_WAKEKILL), so kill/tgkill cannot wake them. The UAF needs the dumper preempted between curr->task=NULL and wake_up_process() long enough for a spurious or freezer wakeup, full do_exit(), and an RCU GP via delayed_put_task_struct() \\u2014 timing the attacker cannot force.\\nPR:L - get_signal() dumps the caller's own dumpable thread group with no capability check. An ordinary user pthread_create()s a sibling and abort()s or faults into vfs_coredump(); coredump_skip() only bails on TASK_DUMPABLE_OFF, which a normal user process is not.\\nUI:N - The attacker creates the extra thread and delivers the dump signal inside their own process; no other user must mount media, open a file, or otherwise act.\\nS:U - try_to_wake_up() on the freed task_struct corrupts host kernel scheduler state inside the same kernel; this is ordinary in-kernel UAF impact, not a VM, IOMMU, or sandbox escape.\\nC:H - wake_up_process() -> try_to_wake_up() reads __state, on_rq, and sched_class from the task_struct after delayed_put_task_struct() has freed it; a sprayable slab UAF read is High confidentiality per UAF guidance.\\nI:H - try_to_wake_up() takes raw_spin_lock on the freed p->pi_lock, writes __state, and calls p->sched_class->enqueue_task(); reclaiming the task_struct slab yields a write and control-flow primitive.\\nA:H - Taking pi_lock in memory already freed by delayed_put_task_struct(), as the fix describes, oopses or panics even without a successful spray, so availability is High.\"}]}], \"providerMetadata\": {\"dateUpdated\": \"2026-11-03T19:12:53.426Z\", \"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\"}, \"references\": [{\"url\": \"https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c\"}, {\"url\": \"https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b\"}, {\"url\": \"https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307\"}, {\"url\": \"https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e\"}, {\"url\": \"https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c\"}, {\"url\": \"https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573\"}, {\"url\": \"https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576\"}], \"title\": \"coredump: hold RCU while releasing parked threads\", \"x_generator\": {\"engine\": \"bippy-1.2.0\"}}}, \"cveMetadata\": {\"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"assignerShortName\": \"Linux\", \"cveId\": \"CVE-2026-99218\", \"datePublished\": \"2026-11-02T16:06:31.088Z\", \"dateReserved\": \"2026-09-25T10:25:14.401Z\", \"dateUpdated\": \"2026-11-03T19:12:53.426Z\", \"state\": \"PUBLISHED\"}, \"dataType\": \"CVE_RECORD\", \"dataVersion\": \"5.2\"}"}],"record":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"61d58591aa0188bf2463e263962256316ff8b576","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cna":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"fd0fbe84312fda2fc187428c92c50b7d03a9d24c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"71146c437bae59e5280f657965dc6d006ee3989b","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"0fce73efee40c65ce26641c5d93942462f9e8307","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"16e94ed90b1b02398e044d41fd1db34828daa08e","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"},{"lessThan":"61d58591aa0188bf2463e263962256316ff8b576","status":"affected","version":"a94e2d408eaedbd85aae259621d46fafc10479a2","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["fs/coredump.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.27"},{"lessThan":"2.6.27","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.191","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.161","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.115","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.60","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.14","versionType":"semver"},{"lessThanOrEqual":"7.3.*","status":"unaffected","version":"7.3.1","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.4-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.1.191","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.6.161","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.12.115","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.60","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.14","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3.1","versionStartIncluding":"2.6.27","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.4-rc1","versionStartIncluding":"2.6.27","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The UAF is in coredump_finish(), reached when a local dump signal is delivered via get_signal() -> vfs_coredump() -> do_coredump()/coredump_cleanup(). abort(), a user page-fault SIGSEGV, or tgkill() on the attacker's own thread group starts that path; no remote protocol supplies the curr->task pointer later handed to wake_up_process().\nAC:H - coredump_wait() parks siblings in coredump_task_exit() in TASK_IDLE (no TASK_WAKEKILL), so kill/tgkill cannot wake them. The UAF needs the dumper preempted between curr->task=NULL and wake_up_process() long enough for a spurious or freezer wakeup, full do_exit(), and an RCU GP via delayed_put_task_struct() \u2014 timing the attacker cannot force.\nPR:L - get_signal() dumps the caller's own dumpable thread group with no capability check. An ordinary user pthread_create()s a sibling and abort()s or faults into vfs_coredump(); coredump_skip() only bails on TASK_DUMPABLE_OFF, which a normal user process is not.\nUI:N - The attacker creates the extra thread and delivers the dump signal inside their own process; no other user must mount media, open a file, or otherwise act.\nS:U - try_to_wake_up() on the freed task_struct corrupts host kernel scheduler state inside the same kernel; this is ordinary in-kernel UAF impact, not a VM, IOMMU, or sandbox escape.\nC:H - wake_up_process() -> try_to_wake_up() reads __state, on_rq, and sched_class from the task_struct after delayed_put_task_struct() has freed it; a sprayable slab UAF read is High confidentiality per UAF guidance.\nI:H - try_to_wake_up() takes raw_spin_lock on the freed p->pi_lock, writes __state, and calls p->sched_class->enqueue_task(); reclaiming the task_struct slab yields a write and control-flow primitive.\nA:H - Taking pi_lock in memory already freed by delayed_put_task_struct(), as the fix describes, oopses or panics even without a successful spray, so availability is High."}]}],"providerMetadata":{"dateUpdated":"2026-11-03T19:12:53.426Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c"},{"url":"https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b"},{"url":"https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307"},{"url":"https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e"},{"url":"https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c"},{"url":"https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573"},{"url":"https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"}],"title":"coredump: hold RCU while releasing parked threads","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-99218","datePublished":"2026-11-02T16:06:31.088Z","dateReserved":"2026-09-25T10:25:14.401Z","dateUpdated":"2026-11-03T19:12:53.426Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"cna_checked":1794500401,"cve":"CVE-2026-99218","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ncoredump: hold RCU while releasing parked threads\n\ncoredump_finish() releases the parked threads by clearing ->task in\ntheir core_thread entry and calling wake_up_process() on each of them.\nIt does that without holding a reference on the task and without being\ninside rcu.\n\nBut calling wake_up_process(task) without rcu here isn't safe. A parked\nthread doesn't need that wakeup to leave. A spurious wakeup or a\npreemption after the store is enough for the task to go away.\n\nSo if the coredump client is preempted between the store and\nwake_up_process() the thread can exit and be freed in the meantime and\ntry_to_wake_up() takes pi_lock in freed memory.\n\nHold rcu across the loop.","epss":{"date":"2026-11-12","epss":0.00122,"percentile":0.02016},"epss_checked":1794522003,"first_seen":1794378631,"kev":null,"kev_checked":1794522003,"products":"Linux Linux","references":["https://git.kernel.org/stable/c/fd0fbe84312fda2fc187428c92c50b7d03a9d24c","https://git.kernel.org/stable/c/71146c437bae59e5280f657965dc6d006ee3989b","https://git.kernel.org/stable/c/0fce73efee40c65ce26641c5d93942462f9e8307","https://git.kernel.org/stable/c/16e94ed90b1b02398e044d41fd1db34828daa08e","https://git.kernel.org/stable/c/a0f09ff4c6b93312e565cfe75d76c3a551a3ec4c","https://git.kernel.org/stable/c/b0eca0edddf4c1dbaf6d1f6a8636b4235f5bc573","https://git.kernel.org/stable/c/61d58591aa0188bf2463e263962256316ff8b576"],"score":{"baseScore":7,"baseSeverity":"HIGH","provider":"Linux","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"solutions":"","state":"PUBLISHED","title":"coredump: hold RCU while releasing parked threads","updated_at":1794500401,"workarounds":""},"sources":[{"canonical_url":"https://www.bleepingcomputer.com/news/microsoft/microsoft-november-2026-patch-tuesday-fixes-1-235-flaws-outlook-zero-day/","id":375,"publisher":"BleepingComputer","title":"Microsoft November 2026 Patch Tuesday fixes 1,235 flaws, Outlook zero-day"}]}