{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-97903", "modified": "2026-10-07T14:35:31Z", "upstream": [ "CVE-2026-97903" ], "published": "2026-09-25T10:24:31Z", "summary": "exit: hold a reference to thread_pid across proc_flush_pid", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: hold a reference to thread_pid across proc_flush_pid\n\nCommit 0a36bad01731 (\"release_task: kill the no longer needed\nget/put_pid(thread_pid)\") removed the reference around proc_flush_pid().\nIt assumed that free_pids(post.pids) at the end of release_task() would\nkeep thread_pid alive until then.\n\nThat assumption is wrong. __change_pid() only records a detached PID in\npost.pids when pid_has_task() is false for every PIDTYPE. If another task\nstill uses the exiting task's PID as its process group or session ID,\n__unhash_process() removes the exiting task's PIDTYPE_PID link but leaves\nthe PID out of post.pids. release_task() therefore holds no reference to\nit after dropping tasklist_lock.\n\nThe other task can then remove the remaining PIDTYPE links. Its\nfree_pids() call schedules delayed_put_pid(), and the RCU callback can free\nthe PID before the first release_task() reaches proc_flush_pid().\n\nAn unprivileged reproducer races wait4(-1) against setsid() to trigger this\nordering. Three of three fresh v7.2 KASAN boots reported:\n\n BUG: KASAN: slab-use-after-free in\n proc_invalidate_siblings_dcache+0x3e2/0x3f0\n Read of size 8 by task h7_pid_reaper/1921\n\n Call Trace:\n proc_invalidate_siblings_dcache\n release_task\n wait_consider_task\n __do_wait\n do_wait\n kernel_wait4\n\n Freed by task 0:\n kmem_cache_free\n put_pid\n delayed_put_pid\n rcu_core\n\n Last potentially related work creation:\n __call_rcu_common\n free_pids\n ksys_setsid\n\nKASAN identified a 144-byte object from the pid cache and located the bad\nread 80 bytes into the freed object, matching pid->inodes. With an\nexplicit reference, three of three fresh boots completed without a KASAN\nreport. The concurrent RCU callback dropped its reference while\nproc_flush_pid() was protected, and the balancing put_pid() performed the\nfinal free afterward.\n\nTake a reference before __unhash_process() clears p->thread_pid and release\nit after proc_flush_pid() completes.\n\nA tested source reproducer is available privately on request. No\ncontrolled read or write, information leak, or privilege escalation is\nclaimed. The mainline patch applies directly to v6.19.y and newer;\nv6.16.y through v6.18.y need a context-adjusted backport.", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.53" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.53" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.53" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.53" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.53" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97903" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/bcb0936862f2b653114d9bd582ca26990ef54a64" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/96803a12e8ac15f0a1b4b151db59038f12304e58" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cdd812d0683dee14ead02c9eded568685e61b23f" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-09-25T14:43:22Z" } }