CVE-2026-72166

Name of the Vulnerable Software and Affected Versions Linux kernel versions 5.4 through 6.12.77

Description An infinite loop occurs in the p9 client rpc() function when it is called with the type P9 TFLUSH and the transport has no peer, such as an fd transport backed by pipes without a 9p server. When a fatal signal is received, the function clears the TIF SIGPENDING flag and jumps back to io wait event killable(). Because the flag is cleared, the task goes back to sleep and only wakes upon the next signal delivery, repeating the cycle indefinitely. This issue can be triggered by coredump wait(), which sends a SIGKILL to threads during a coredump; if a thread is blocked in the p9 client rpc() loop, it never calls mm release(), causing coredump wait() to stall permanently.

Recommendations Update the Linux kernel to a version where the p9 client rpc() function is patched to check fatal signal pending() before clearing TIF SIGPENDING in the P9 TFLUSH retry loop.