kernel: exit: hold a reference to thread_pid across proc_flush_pid

cve CVE-2026-97903 3 sources, 4 claims · Watch

Red Hat writes:
kernel: exit: hold a reference to thread_pid across proc_flush_pid the claim

Severity they disagree: high GitHub advisories
HIGH NVD
moderate Red Hat
CVSS they disagree: 7.8 GitHub advisories
7.8 NVD
7 Red Hat
Vendor: Linux NVD
Product: Linux NVD
CWE: CWE-825 Red Hat

How far exploitation has got

No public code known
Proof of concept
Proof of concept, verified
A Metasploit module
Exploited in the wild
Used in ransomware campaigns

Why the CVSS differs

Metric	NVD	Red Hat
Attack vector AV	local L	local L
Attack complexity AC	low L	high H
Privileges required PR	low L	low L
User interaction UI	none N	none N
Scope S	unchanged U	unchanged U
Confidentiality C	high H	high H
Integrity I	high H	high H
Availability A	high H	high H

Each source scores the same vulnerability from what it judges the attack to need. The rows marked are where they judge it differently.

Timeline

2026-09-25	first spoke of it: In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to...	GitHub advisories
2026-09-25	first spoke of it: In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption is wrong. __change_pid() only records a detached PID in post.pids when pid_has_task() is false for every PIDTYPE. If another task still uses the exiting task's PID as its process group or session ID, __unhash_process() removes the exiting task's PIDTYPE_PID link but leaves the PID out of post.pids. release_task() therefore holds no reference to it after dropping tasklist_lock. The other task can then remove the remaining PIDTYPE links. Its free_pids() call schedules delayed_put_pid(), and the RCU callback can free the PID before the first release_task() reaches proc_flush_pid(). An unprivileged reproducer races wait4(-1) against setsid() to trigger this ordering. Three of three fresh v7.2 KASAN boots reported: BUG: KASAN: slab-use-after-free in proc_invalidate_siblings_dcache+0x3e2/0x3f0 Read of size 8 by task h7_pid_reaper/1921 Call Trace: proc_invalidate_siblings_dcache release_task wait_consider_task __do_wait do_wait kernel_wait4 Freed by task 0: kmem_cache_free put_pid delayed_put_pid rcu_core Last potentially related work creation: __call_rcu_common free_pids ksys_setsid KASAN identified a 144-byte object from the pid cache and located the bad read 80 bytes into the freed object, matching pid->inodes. With an explicit reference, three of three fresh boots completed without a KASAN report. The concurrent RCU callback dropped its reference while proc_flush_pid() was protected, and the balancing put_pid() performed the final free afterward. Take a reference before __unhash_process() clears p->thread_pid and release it after proc_flush_pid() completes. A tested source reproducer is available privately on request. No controlled read or write, information leak, or privilege escalation is claimed. The mainline patch applies directly to v6.19.y and newer; v6.16.y through v6.18.y need a context-adjusted backport.	NVD
2026-09-25	first spoke of it: kernel: exit: hold a reference to thread_pid across proc_flush_pid	Red Hat

What it is to other things

In words only, so not counted until a person confirms one:

made_by	`linux` NVD says “Linux”
affects	`linux/linux` NVD says “Linux · Linux”

Every value, with what each source said and its receipt

Property Source Said Means here

CVSS

cvss

conflict

GitHub advisories

7.8

receipt

Source: GitHub advisories
Said since: 2026-09-26 15:00 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

This source has not kept a receipt for this claim yet. The next update that reads it will.

—

CVSS

cvss

conflict

NVD

7.8

receipt

Source: NVD
Its words: 7.8
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseScore || field:cve.metrics.cvssMetricV31[].cvssData.baseScore
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

CVSS

cvss

conflict

Red Hat

receipt

Source: Red Hat
Its words: 7.0
Read by: field:cvss3_score
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97903",
  "CWE": "CWE-825",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541243",
  "bugzilla_description": "kernel: exit: hold a reference to thread_pid across proc_flush_pid",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97903.json",
  "severity": "moderate"
}

—

CVSS vector

cvss_vector

not compared

NVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

receipt

Source: NVD
Its words: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.vectorString || field:cve.metrics.cvssMetricV31[].cvssData.vectorString
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

CVSS vector

cvss_vector

not compared

Red Hat

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

receipt

Source: Red Hat
Its words: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Read by: field:cvss3_scoring_vector
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97903",
  "CWE": "CWE-825",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541243",
  "bugzilla_description": "kernel: exit: hold a reference to thread_pid across proc_flush_pid",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97903.json",
  "severity": "moderate"
}

—

CWE

cwe

Red Hat

CWE-825

receipt

Source: Red Hat
Its words: CWE-825
Read by: field:CWE
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97903",
  "CWE": "CWE-825",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541243",
  "bugzilla_description": "kernel: exit: hold a reference to thread_pid across proc_flush_pid",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97903.json",
  "severity": "moderate"
}

—

Product

product

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].product
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Severity

severity

conflict

GitHub advisories

high

From 7.0 to 8.9.

receipt

Source: GitHub advisories
Said since: 2026-09-26 15:00 UTC
Last answered: 2026-10-06 13:46 UTC
Original: open at the source

This source has not kept a receipt for this claim yet. The next update that reads it will.

—

Severity

severity

conflict

NVD

HIGH

From 7.0 to 8.9.

receipt

Source: NVD
Its words: HIGH
Read by: field:cve.metrics.cvssMetricV31[type=Primary].cvssData.baseSeverity || field:cve.metrics.cvssMetricV31[].cvssData.baseSeverity
Said since: 2026-10-06 12:31 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-10-06 12:31 UTC	HIGH
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

high

Severity

severity

conflict

Red Hat

moderate

A flaw that is harder to exploit, or whose impact is limited.

receipt

Source: Red Hat
Its words: moderate
Read by: field:severity
Said since: 2026-10-06 13:01 UTC
Last answered: 2026-10-06 13:02 UTC
Original: open at the source

What the source handed over

{
  "CVE": "CVE-2026-97903",
  "CWE": "CWE-825",
  "advisories": [],
  "affected_packages": [],
  "bugzilla": "2541243",
  "bugzilla_description": "kernel: exit: hold a reference to thread_pid across proc_flush_pid",
  "cvss3_score": "7.0",
  "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "cvss_score": null,
  "cvss_scoring_vector": null,
  "package_state": null,
  "public_date": "2026-09-25T00:00:00Z",
  "resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-97903.json",
  "severity": "moderate"
}

medium

Status

status

NVD

Received

receipt

Source: NVD
Its words: Received
Read by: field:cve.vulnStatus
Said since: 2026-09-29 09:45 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Vendor

vendor

NVD

Linux

receipt

Source: NVD
Its words: Linux
Read by: field:cve.affected[].affectedData[].vendor
Said since: 2026-09-29 17:49 UTC
Last answered: 2026-10-06 12:41 UTC
Original: open at the source

2026-09-29 17:49 UTC	Linux
2026-09-29 09:45 UTC	—

What the source handed over

{
  "cve": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "bcb0936862f2b653114d9bd582ca26990ef54a64",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "96803a12e8ac15f0a1b4b151db59038f12304e58",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              },
              {
                "lessThan": "cdd812d0683dee14ead02c9eded568685e61b23f",
                "status": "affected",
                "version": "0a36bad01731e71568bdd365764d38b6bd576ab0",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "kernel/exit.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.16"
              },
              {
                "lessThan": "6.16",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.53",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.2.*",
                "status": "unaffected",
                "version": "7.2.7",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.3-rc3",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport."
      }
    ],
    "id": "CVE-2026-97903",
    "lastModified": "2026-09-25T15:18:01.960",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-09-25T11:17:17.150",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Received"
  }
}

—

Every claim, by kind

vulnerability

kernel: exit: hold a reference to thread_pid across proc_flush_pid zetlyn/cve-redhat · 2026-09-25	cvss 7 cvss_vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H cwe CWE-825 severity moderate	source
In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to thread_pid across proc_flush_pid Commit 0a36bad01731 ("release_task: kill the no longer needed get/put_pid(thread_pid)") removed the reference around proc_flush_pid(). It assumed that free_pids(post.pids) at the end of release_task() would keep thread_pid alive until then. That assumption is wrong. __change_pid() only records a detached PID in post.pids when pid_has_task() is false for every PIDTYPE. If another task still uses the exiting task's PID as its process group or session ID, __unhash_process() removes the exiting task's PIDTYPE_PID link but leaves the PID out of post.pids. release_task() therefore holds no reference to it after dropping tasklist_lock. The other task can then remove the remaining PIDTYPE links. Its free_pids() call schedules delayed_put_pid(), and the RCU callback can free the PID before the first release_task() reaches proc_flush_pid(). An unprivileged reproducer races wait4(-1) against setsid() to trigger this ordering. Three of three fresh v7.2 KASAN boots reported: BUG: KASAN: slab-use-after-free in proc_invalidate_siblings_dcache+0x3e2/0x3f0 Read of size 8 by task h7_pid_reaper/1921 Call Trace: proc_invalidate_siblings_dcache release_task wait_consider_task __do_wait do_wait kernel_wait4 Freed by task 0: kmem_cache_free put_pid delayed_put_pid rcu_core Last potentially related work creation: __call_rcu_common free_pids ksys_setsid KASAN identified a 144-byte object from the pid cache and located the bad read 80 bytes into the freed object, matching pid->inodes. With an explicit reference, three of three fresh boots completed without a KASAN report. The concurrent RCU callback dropped its reference while proc_flush_pid() was protected, and the balancing put_pid() performed the final free afterward. Take a reference before __unhash_process() clears p->thread_pid and release it after proc_flush_pid() completes. A tested source reproducer is available privately on request. No controlled read or write, information leak, or privilege escalation is claimed. The mainline patch applies directly to v6.19.y and newer; v6.16.y through v6.18.y need a context-adjusted backport. zetlyn/cve-nvd · 2026-09-25	cvss 7.8 cvss_vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H product Linux severity HIGH status Received vendor Linux	source
In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to... zetlyn/cve-ghsa · 2026-09-25	cvss 7.8 severity high	source
In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to... zetlyn/cve-ghsa · 2026-09-25	cvss 7.8 severity high	source