Executive brief
The Linux kernel's 9p network protocol handler contains a logic error that causes threads to hang indefinitely when receiving fatal signals (like SIGKILL). This can prevent system processes from completing their shutdown sequences, potentially blocking coredump operations and delaying system shutdown.
Technical details
The vulnerability is a logic error in the net/9p driver's p9_client_rpc() function when handling P9_TFLUSH messages over file descriptor transports with no active peer. When a fatal signal (SIGKILL) interrupts an io_wait_event_killable() call, the code clears the TIF_SIGPENDING thread flag before retrying the wait, causing signal_pending_state() to incorrectly report no pending signals. The task then sleeps indefinitely until the next signal delivery occurs, creating an infinite loop. The vulnerability is triggered in practice when coredump_wait() sends SIGKILL to threads and one is blocked in p9_client_rpc(); the thread never calls mm_release(), causing the coredump operation to hang. The fix checks fatal_signal_pending() before clearing TIF_SIGPENDING and restores the flag if a fatal signal is detected, allowing proper cleanup. This flaw affects stable kernel versions from 5.4 onwards.
Affected products
- Linux Linux kernel 5.4 and later (up to at least 6.12.77)
Timeline
- 2026-08-15: disclosed
- patched: Fix involves checking fatal_signal_pending() before clearing TIF_SIGPENDING in the P9_TFLUSH retry loop