{"id":"CVE-2026-97903","revision":"2f157eadcd6e49a185574d2f52098a81","records":[{"revision":"2f157eadcd6e49a185574d2f52098a81","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97903","aliases":[],"title":"exit: hold a reference to thread_pid across proc_flush_pid","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport.","state":0,"publishedAt":"2026-09-25T10:22:29.852+00:00","modifiedAt":"2026-10-19T09:10:29.542+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/exit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"0a36bad01731e71568bdd365764d38b6bd576ab0\",\n                            \"lessThan\": \"bcb0936862f2b653114d9bd582ca26990ef54a64\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0a36bad01731e71568bdd365764d38b6bd576ab0\",\n                            \"lessThan\": \"96803a12e8ac15f0a1b4b151db59038f12304e58\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"0a36bad01731e71568bdd365764d38b6bd576ab0\",\n                            \"lessThan\": \"cdd812d0683dee14ead02c9eded568685e61b23f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"kernel/exit.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.53\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.7\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64","https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58","https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97903","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97903","identifiers":["CVE-2026-97903"]},"retained":false,"historicalAffected":[]}],"coverage":[]}