# CVE-2026-99218: coredump: hold RCU while releasing parked threads

CVE-2026-99218 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99218, released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-99218
- Priority: High
- CVSS: 7.0 (Moderate)
- EPSS: 0.0012
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 2, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99218

## Description

In the Linux kernel, the following vulnerability has been resolved:  coredump: hold RCU while releasing parked threads  coredump_finish() releases the parked threads by clearing ->task in their core_thread entry and calling wake_up_process() on each of them. It does that without holding a reference on the task and without being inside rcu.  But calling wake_up_process(task) without rcu here isn't safe. A parked thread doesn't need that wakeup to leave. A spurious wakeup or a preemption after the store is enough for the task to go away.  So if the coredump client is preempted between the store and wake_up_process() the thread can exit and be freed in the meantime and try_to_wake_up() takes pi_lock in freed memory.  Hold rcu across the loop.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-1 | [DEBIAN-CVE-2026-99218](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99218.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.14-1 | [DEBIAN-CVE-2026-99218](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99218.md) | Nov 3, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.