Linux Kernel: Use-after-free in coredump_finish() (CVE-2026-99218)
A vulnerability in the Linux kernel coredump implementation exists where coredump_finish() fails to maintain an RCU lock while releasing parked threads, leading to a potential use-after-free condition.
CVE search metadata
CVE search record: CVE-2026-99218. Severity: high. CVSS: 7.0. EPSS: 0.12%. KEV: no. Product: Linux kernel. Brief: Linux Kernel: Use-after-free in coredump_finish() (CVE-2026-99218). Brief link: https://feed.craftedsignal.io/briefs/2026-11-linux-kernel-coredump-race/
Triage facts
Revision 1- Applicability
- Linux kernel
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 5, 16:32 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
In the Linux kernel, coredump_finish() releases parked threads without holding an RCU reference. If the process is preempted between clearing the task pointer and calling wake_up_process(), the target thread may exit and be freed. This results in a use-after-free condition when try_to_wake_up() attempts to acquire a pi_lock on the freed memory.
Impact
This vulnerability may lead to kernel instability.