From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D18423630BA for ; Sat, 15 Aug 2026 06:16:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774614; cv=none; b=uaId6K/nwXbkC8rPt8PMpqjPR99T2G/vf+mMmttQMTEq5sS/zxMStpU8G/SqAA4ADkuwOHbJ4Z++mlgPoy0ebgCyCJxrG5OkqQBrAhZcaYE8Yl4ZtEC+HzbGMSU5scZKzWeyj+NQP6wOTL4LnKauxKaV0erxWYpEv5DwEmWzvJ8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774614; c=relaxed/simple; bh=kXBE+rkjkSzLhqGF6xGeGcfUCxKPKwq4urMHAmKJVIg=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=j3+FAyKR/CC+R4IcYV8nIqx6AcxQArbeXYBuq/t9PP8RukOHaFRgQx6mI6PbI0p06tUjMphnRncMKf/tM2bfKtStYBDWyyL/+cs7Ge/6vBaT26cWSHTioG0rSd268m0LCqRmQWl9B+CHHj/7cmJdYQUiPcHdCkNhdl01U23mH74= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=m/VP9tcA; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="m/VP9tcA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3411F1F000E9; Sat, 15 Aug 2026 06:16:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786774612; bh=TVvQJSKdO7VV9ur84H0BCZRMUO15ipYVGaWecfe9CQI=; h=From:To:Cc:Subject:Date:Reply-To; b=m/VP9tcA2WxVBWeI8xKav6bF55eEFbBAiwrNVwGQv+8ZNrQogMQSxk+Pd4umE1hQ/ 2ZLaMUT0FAC6xj2xPKuTuyKDjfzmyNI1uqfqijQj9+dEB3duqDG66C+834gVCslqhr e5+BkaNGK6YGanQD1KAuRh8IV9s/NYxhJWNQcXlQ= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72166: net/9p: fix infinite loop in p9_client_rpc on fatal signal Date: Sat, 15 Aug 2026 15:04:05 +0900 Message-ID: <2026081537-CVE-2026-72166-622b@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6188; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=xkETEzCVwprnnRQapJtZ35dBX5+jaDnBUpNFpnSSfFc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDAeP2l3Ys+THq1mn05y/lEe8FqxvMt7En+2ZMOtLh blzb8bEjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZhIxBKG+V6zWvfMWsqWr7jh rNCXd1nhQgeagKJh/KL7LxlfTr3cM1ut9crC5DcHuDgA X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: net/9p: fix infinite loop in p9_client_rpc on fatal signal When p9_client_rpc() is called with type P9_TFLUSH and the transport has no peer (e.g. fd transport backed by pipes with no 9p server), a fatal signal causes an infinite loop: again: err = io_wait_event_killable(req->wq, ...) /* SIGKILL wakes the task, returns -ERESTARTSYS */ if (err == -ERESTARTSYS && c->status == Connected && type == P9_TFLUSH) { sigpending = 1; clear_thread_flag(TIF_SIGPENDING); goto again; } clear_thread_flag() clears TIF_SIGPENDING before jumping back to io_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING, finds it zero, and the task goes to sleep again. The task can only wake on the next signal delivery that calls signal_wake_up() and sets TIF_SIGPENDING again. When that happens the loop repeats, clears TIF_SIGPENDING, and sleeps again indefinitely. This is triggered in practice by coredump_wait(): when a thread in a multi-threaded process causes a coredump (e.g. via SIGSYS from Syscall User Dispatch), coredump_wait() sends SIGKILL to all other threads and waits for them to call mm_release(). If one of those threads is blocked in p9_client_rpc() over an fd transport with no peer, it enters the P9_TFLUSH loop and never calls mm_release(), so coredump_wait() stalls forever: INFO: task syz.0.18:676 blocked for more than 143 seconds. Not tainted 6.12.77+ #1 task:syz.0.18 state:D stack:27600 pid:676 tgid:673 ppid:630 flags:0x00000004 Call Trace: context_switch kernel/sched/core.c:5344 [inline] __schedule+0xcb4/0x5d50 kernel/sched/core.c:6724 __schedule_loop kernel/sched/core.c:6801 [inline] schedule+0xe5/0x350 kernel/sched/core.c:6816 schedule_timeout+0x253/0x290 kernel/time/timer.c:2593 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common+0x409/0x600 kernel/sched/completion.c:116 wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion_state+0x1d/0x40 kernel/sched/completion.c:264 coredump_wait fs/coredump.c:448 [inline] do_coredump+0x854/0x4350 fs/coredump.c:629 get_signal+0x1425/0x2730 kernel/signal.c:2903 arch_do_signal_or_restart+0x81/0x880 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xf9/0x160 kernel/entry/common.c:218 do_syscall_64+0x102/0x220 arch/x86/entry/common.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fix: check fatal_signal_pending() before clearing TIF_SIGPENDING in the P9_TFLUSH retry loop. At that point TIF_SIGPENDING is still set, so fatal_signal_pending() works correctly. If a fatal signal is pending, jump to recalc_sigpending to restore TIF_SIGPENDING and return -ERESTARTSYS to the caller. The same defect is present in stable kernels back to 5.4. On those kernels the infinite loop is broken earlier by a second SIGKILL from the parent process (e.g. kill_and_wait() retrying after a timeout), resulting in a zombie process and a shutdown delay rather than a permanent D-state hang, but the underlying flaw is the same. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. The Linux kernel CVE team has assigned CVE-2026-72166 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 5.15.212 with commit 378481cc60a937ef8ea4ef6e4f95f0dbc4e21414 Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 6.1.178 with commit 4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8 Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 6.6.145 with commit f62a1f245a71680033260a6f6d74011cc3acb3cd Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 6.12.97 with commit dc892cbb1e4341d427b1f940ebd6abd69bf8e479 Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 6.18.40 with commit a8874c34c4a973f9922908a4b8be1d1278f01e42 Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 7.1.5 with commit 823886a1b089b49bcd349bc8bd3417b7910cd1ac Issue introduced in 2.6.28 with commit 91b8534fa8f5e01f249b1bf8df0a2540053549ad and fixed in 7.2-rc1 with commit 6b4f48728faa8bb514368f7eacda05565dea8696 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72166 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/9p/client.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/378481cc60a937ef8ea4ef6e4f95f0dbc4e21414 https://git.kernel.org/stable/c/4f621ae3a2d99b0bac50e8d66cbf7f68323c01e8 https://git.kernel.org/stable/c/f62a1f245a71680033260a6f6d74011cc3acb3cd https://git.kernel.org/stable/c/dc892cbb1e4341d427b1f940ebd6abd69bf8e479 https://git.kernel.org/stable/c/a8874c34c4a973f9922908a4b8be1d1278f01e42 https://git.kernel.org/stable/c/823886a1b089b49bcd349bc8bd3417b7910cd1ac https://git.kernel.org/stable/c/6b4f48728faa8bb514368f7eacda05565dea8696