CVE-2026-72166

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/9p: fix infinite loop in p9_client_rpc on fatal signal

When p9_client_rpc() is called with type P9_TFLUSH and the transport

has no peer (e.g. fd transport backed by pipes with no 9p server),

a fatal signal causes an infinite loop:

again:

err = io_wait_event_killable(req->wq, ...)

/* SIGKILL wakes the task, returns -ERESTARTSYS */

if (err == -ERESTARTSYS && c->status == Connected &&

type == P9_TFLUSH) {

sigpending = 1;

clear_thread_flag(TIF_SIGPENDING);

goto again;

}

clear_thread_flag() clears TIF_SIGPENDING before jumping back to

io_wait_event_killable(). signal_pending_state() checks TIF_SIGPENDING,

finds it zero, and the task goes to sleep again. The task can only wake

on the next signal delivery that calls signal_wake_up() and sets

TIF_SIGPENDING again. When that happens the loop repeats, clears

TIF_SIGPENDING, and sleeps again indefinitely.

This is triggered in practice by coredump_wait(): w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References