CVE-2026-97903

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

exit: hold a reference to thread_pid across proc_flush_pid

Commit 0a36bad01731 ("release_task: kill the no longer needed

get/put_pid(thread_pid)") removed the reference around proc_flush_pid().

It assumed that free_pids(post.pids) at the end of release_task() would

keep thread_pid alive until then.

That assumption is wrong. __change_pid() only records a detached PID in

post.pids when pid_has_task() is false for every PIDTYPE. If another task

still uses the exiting task's PID as its process group or session ID,

__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves

the PID out of post.pids. release_task() therefore holds no reference to

it after dropping tasklist_lock.

The other task can then remove the remaining PIDTYPE links. Its

free_pids() call schedules delayed_put_pid(), and the RCU callback can free

the PID before the first release_task() reaches proc_flush_pid().

An unprivileged repro

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References