CVE-2026-99244

In the Linux kernel, the following vulnerability has been resolved:

pid namespace: prevent TIF NOTIFY SIGNAL from interrupting the reaper

Since commit 7fea700e04bd ("zap pid ns processes: clear TIF NOTIFY SIGNAL along with TIF SIGPENDING") zap pid ns processes() clears TIF NOTIFY SIGNAL before every kernel wait4() call. Otherwise kernel wait4() doesn't sleep and returns -ERESTARTSYS if signal pending() is true and the reaper busy-waits.

But clearing TIF NOTIFY SIGNAL doesn't fix it. It can get raised again. For example, klp send signals() sets it raw against any task that hasn't transitioned yet. And it keeps sending it until the livepatch finishes.

The sleep loop waiting for pid allocated to drop has the same problem and it doesn't even clear anything. So a schedule() in TASK INTERRUPTIBLE returns immediately.

Use a no notify signal guard. signal pending() will ignore TIF NOTIFY SIGNAL and the pid namespace reaper sleeps until a child exits or free pid() wakes it.