{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97903", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:18:58.200Z", "datePublished": "2026-09-25T10:22:29.852Z", "dateUpdated": "2026-09-25T14:41:35.285Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:35.285Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong. __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE. If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids. release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links. Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering. Three of three fresh v7.2 KASAN boots reported:\n\n BUG: KASAN: slab-use-after-free in\n proc_invalidate_siblings_dcache+0x3e2/0x3f0\n Read of size 8 by task h7_pid_reaper/1921\n\n Call Trace:\n proc_invalidate_siblings_dcache\n release_task\n wait_consider_task\n __do_wait\n do_wait\n kernel_wait4\n\n Freed by task 0:\n kmem_cache_free\n put_pid\n delayed_put_pid\n rcu_core\n\n Last potentially related work creation:\n __call_rcu_common\n free_pids\n ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes. With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport. The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request. No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed. The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The freed struct pid is reached through release_task() -> proc_flush_pid() when a local process reaps a child via wait4()/waitid(), racing with ksys_setsid() in another local process; no network or remote data is involved.\nAC:L - The attacker controls both sides of the race: its own parent calls wait4(-1) on an exiting process-group leader while its own child, still in that pgrp, calls setsid() to drop the last PID link. The loop can be retried without limit, and syzbot plus the author's reproducer hit it reliably.\nPR:L - Needs only an ordinary local account able to fork, setpgid/setsid and wait4 its own children. There is no capability check anywhere on the release_task()/ksys_setsid() path.\nUI:N - The attacker triggers the whole sequence with its own processes. No other user or administrator action is needed.\nS:U - This is memory corruption inside the kernel's own pid/procfs bookkeeping, which stays within the kernel security authority; no VM or hardware isolation boundary is crossed.\nC:H - proc_invalidate_siblings_dcache() reads pid->inodes from the freed struct pid and follows it as a proc_inode pointer (igrab, d_find_alias). With the slot reclaimed by attacker-shaped data, that use-after-free lets the attacker dereference pointers it controls, which supports kernel memory disclosure.\nI:H - On the freed object the function takes spin_lock(&pid->lock) and runs hlist_del_init_rcu() on node pointers taken from it, which are unlink-style writes. It then calls igrab/iput/d_invalidate on an inode it derived from freed memory, a use-after-free write primitive usable for memory corruption.\nA:H - KASAN reports a slab-use-after-free in proc_invalidate_siblings_dcache from release_task. Without KASAN, the list walk or igrab on a reallocated pid slot can oops or corrupt the dcache and crash the kernel."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/exit.c"], "versions": [{"version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64", "status": "affected", "versionType": "git"}, {"version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58", "status": "affected", "versionType": "git"}, {"version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["kernel/exit.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"}, {"url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"}, {"url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"}], "title": "exit: hold a reference to thread_pid across proc_flush_pid", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["kernel/exit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64", "status": "affected", "version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "versionType": "git"}, {"lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58", "status": "affected", "version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "versionType": "git"}, {"lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f", "status": "affected", "version": "0a36bad01731e71568bdd365764d38b6bd576ab0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["kernel/exit.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong. __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE. If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids. release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links. Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering. Three of three fresh v7.2 KASAN boots reported:\n\n BUG: KASAN: slab-use-after-free in\n proc_invalidate_siblings_dcache+0x3e2/0x3f0\n Read of size 8 by task h7_pid_reaper/1921\n\n Call Trace:\n proc_invalidate_siblings_dcache\n release_task\n wait_consider_task\n __do_wait\n do_wait\n kernel_wait4\n\n Freed by task 0:\n kmem_cache_free\n put_pid\n delayed_put_pid\n rcu_core\n\n Last potentially related work creation:\n __call_rcu_common\n free_pids\n ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes. With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport. The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request. No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed. The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."}], "id": "CVE-2026-97903", "lastModified": "2026-09-25T15:18:01.960", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:17.150", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{"created": "2026-09-25T14:30:14.460850+00:00", "updated": "2026-09-25T14:30:14.460855+00:00", "vendors": [], "weaknesses": ["CWE-416", "CWE-362"]}