{"schema":"threatline.record/2","record":{"id":"CVE-2026-97903","aliases":[],"summary":"exit: hold a reference to thread_pid across proc_flush_pid","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong.  __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE.  If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids.  release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links.  Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering.  Three of three fresh v7.2 KASAN boots reported:\n\n    BUG: KASAN: slab-use-after-free in\n    proc_invalidate_siblings_dcache+0x3e2/0x3f0\n    Read of size 8 by task h7_pid_reaper/1921\n\n    Call Trace:\n     proc_invalidate_siblings_dcache\n     release_task\n     wait_consider_task\n     __do_wait\n     do_wait\n     kernel_wait4\n\n    Freed by task 0:\n     kmem_cache_free\n     put_pid\n     delayed_put_pid\n     rcu_core\n\n    Last potentially related work creation:\n     __call_rcu_common\n     free_pids\n     ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes.  With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport.  The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request.  No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed.  The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport.","categories":["Operating systems"],"product":"Linux","vendor":"Linux","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97903","source_modified_at":"2026-10-19T09:10:29.542Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"bcb0936862f2b653114d9bd582ca26990ef54a64","status":"affected","versionType":"git"},{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"96803a12e8ac15f0a1b4b151db59038f12304e58","status":"affected","versionType":"git"},{"version":"0a36bad01731e71568bdd365764d38b6bd576ab0","lessThan":"cdd812d0683dee14ead02c9eded568685e61b23f","status":"affected","versionType":"git"}],"defaultStatus":"unaffected"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97903","source_modified_at":"2026-10-19T09:10:29.542Z","fetched_at":"2026-10-23T18:45:31.882637Z","product":"Linux","vendor":"Linux","versions":[{"version":"6.16","status":"affected"},{"version":"0","lessThan":"6.16","status":"unaffected","versionType":"semver"},{"version":"6.18.53","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.2.7","lessThanOrEqual":"7.2.*","status":"unaffected","versionType":"semver"},{"version":"7.3","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}],"defaultStatus":"affected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97903","source_modified_at":"2026-10-19T09:10:29.542Z","fetched_at":"2026-10-23T18:45:31.882637Z","package":{"name":"Linux","ecosystem":null},"version":"96803a12e8ac15f0a1b4b151db59038f12304e58","basis":"first unaffected version stated in the CVE record"}],"cvss":7.8,"severity":"High","kev":{"listed":false},"epss":{"probability":0.00124,"percentile":0.0193,"score_date":"2026-10-23"},"published_at":"2026-09-25T10:22:29.852Z","modified_at":"2026-10-19T09:10:29.542Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-97903","fetched_at":"2026-10-23T18:45:31.882637Z","source_modified_at":"2026-10-19T09:10:29.542Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97903","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58"},{"source":"CVE List","url":"https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-19T09:10:29.542Z","content_hash":"c13c2b76aad87edfe5481dba584881be28d4bc08e74a2945eba712c5f5d12512"}}