CVE-2026-99249

In the Linux kernel, the following vulnerability has been resolved:

pid namespace: make zap pid ns processes() freezable

When the init of a pid namespace exits, zap pid ns processes() waits until all other pids in the namespace are freed. A tracer outside the namespace that does not reap its traced zombies keeps those pids allocated, so this wait has no upper bound, and while it lasts every suspend attempt fails:

Freezing user space processes failed after 20.006 seconds (2 tasks refusing to freeze, wq busy=0):

Neither wait is freezable. The first loop sleeps in do wait(), which returns -ERESTARTSYS on the freezer's fake signal; the loop then clears TIF SIGPENDING and waits again without ever freezing. The final loop sleeps in TASK INTERRUPTIBLE, and since nothing clears TIF SIGPENDING there, schedule() returns immediately after the first freeze attempt and the task spins until the wait ends.

Sleep in TASK INTERRUPTIBLE | TASK FREEZABLE in do wait(), so that the freezer can freeze tasks waiting there directly, and in TASK IDLE | TASK FREEZABLE in the final loop, like coredump task exit() does.

This was hit with Chromium-based browsers: crashpad ptrace-attaches the threads of a crashed renderer, which is a pid namespace init, and does not reap those killed during the dump.