VulnerabilityPublished 2 Nov 2026

CVE-2026-99217: Linux kernel · fork: release the files of a failed fork after sched_cancel_fork()

Source GCVE Database

Compare

Authoritative record:CVE-2026-99217· High

Not known to be exploited · fixed in f7ac8500d58e7684d37403553b1dea90ee2b27b1 : patch Linux kernel soon.

Data as of 2 Nov 2026, 19:30 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Patch: Available – fixed in f7ac8500d58e7684d37403553b1dea90ee2b27b1, afa8eb069694bd9f845e5e44eac6e81cbc06780e, 27e1cbf8ec5f7117f6bb2d2e44030ac055f09097 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 2 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-qvc7-5g9j-c6v2

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected <6.12.115 <6.18.60 <7.2.14 <7.3.1	Fixed in f7ac8500d58e7684d37403553b1dea90ee2b27b1 afa8eb069694bd9f845e5e44eac6e81cbc06780e 27e1cbf8ec5f7117f6bb2d2e44030ac055f09097 14c7de6ca239326b79fd3f7aee55dfada1bb72ab 7.3.1 7.2.14 6.18.60 6.12.115

AI-suggested

A fix has been implemented in the Linux kernel to reorder the cleanup process in copy_process() and properly release file descriptors after a failed fork. Users should apply the official kernel updates that include this fix. Since this is a kernel-level issue, updating to the fixed kernel version is the recommended mitigation.

Description

A vulnerability in the Linux kernel's fork implementation could cause a deadlock and system-wide fork blocking due to improper cleanup of files after a failed fork operation. The issue arises when a fork fails while another thread closes a BPF link file descriptor, leading to a deadlock on the read side and blocking all forks on the system.

Impact

The vulnerability can cause deadlocks during fork operations, blocking all forks system-wide. This can lead to denial of service conditions where new processes cannot be created, potentially impacting system stability and availability.

Summary

CVE-2026-99217 addresses a flaw in the Linux kernel where the cleanup sequence in copy_process() was reordered to prevent deadlocks. The problem occurs because a failed fork operation does not release the child's file descriptors properly after sched_cancel_fork() releases the lock. This leads to exit_files() running on a task whose files pointer still references the parent's file table, causing deadlocks when closing BPF link file descriptors. The fix involves clearing the child's files pointer early so that exit_files() becomes a no-op for failed forks and ensuring copy_files() explicitly sets the files pointer for CLONE_FILES.

References

Community reviews

Loading reviews…