Linux Kernel CVE-2026-99218

Requires local code execution as an unprivileged user on an affected Linux kernel and the ability to drive a multithreaded process into a core dump (the vulnerable path is coredump_finish() releasing parked threads). The specific trigger is a timing race: the coredump client must be preempted between storing into the core_thread ->task entry and calling wake_up_process(), allowing a parked thread to exit and be freed so the subsequent wakeup dereferences pi_lock in freed memory. Limiting factors: exploitation is local-only (AV:L), demands a non-deterministic race window the attacker does not fully control (AC:H), and still requires some privilege/local access (PR:L); there is no remote vector and no user-interaction path. These constraints materially reduce real-world risk below what the 7.0 base score alone suggests.

The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a locally-triggered, high-complexity, low-privilege kernel use-after-free with high confidentiality, integrity and availability impact. The high complexity is grounded in the evidence: exploitation depends on winning a narrow race in which the coredump client is preempted between clearing ->task and calling wake_up_process(), so that try_to_wake_up() operates on a freed task_struct's pi_lock. No KEV listing is present and no EPSS score was supplied, so there is no signal of active or probable exploitation; the vuln.today decision label is 'this_week' rather than act_now/emergency. The references are all git.kernel.org stable fix commits, not exploit code, so there is no public exploit identified. Net: this is a genuine local kernel memory-corruption bug worth patching on a normal cycle, but it is not a widespread-exploitation emergency - the local-only vector, the required race, and the absence of KEV/EPSS/PoC signals all point to a moderate, non-urgent priority rather than a high-CVSS issue masking real-world danger. Missing data to note explicitly: no EPSS probability was provided, KEV status is not asserted (treated as not listed), CWE is N/A in the input though the mechanism is clearly a use-after-free, and exact fixed kernel version numbers are not given - only commit hashes.

A local unprivileged user runs a multithreaded program that triggers a core dump, then repeatedly induces scheduler preemption of the dumping thread to hit the window where a parked thread exits and is freed before wake_up_process() runs, causing the kernel to touch pi_lock in freed memory. Reliably landing this requires winning the narrow race many times, consistent with the AC:H rating. No public exploit code was identified in the provided sources.