GNU Coreutils fixes timeout hangs with SIGCHLD and SIGALRM signal handling

GNU Coreutils has merged a fix for signal-handling bugs in the timeout(1) utility that could cause hangs or incorrect behavior when users specified --signal=CHLD or --signal=ALRM. The regression originated in 2011 when SIGCHLD and SIGALRM were incorrectly ignored, and worsened in 2017 when a subsequent change caused timeout to hang upon child exit when -sCHLD was used. The fix modifies send_sig() in src/timeout.c to properly handle these internally-used signals: it no longer ignores SIGHLD, discards self-sent SIGALRM instances, and rearms the signal handler as needed.

The patch includes new test cases in tests/timeout/timeout.sh and a NEWS entry documenting the fixes. Notably, the bug was discovered by Anthropic's OSS Scanner and filed as ANT-2026-2EQL2L05, marking a rare public attribution of a vulnerability-class finding in foundational Unix tooling to an AI company's automated scanning infrastructure.

Signal-handling mechanics in timeout(1)

• SIGCHLD handling: The send_sig() function no longer ignores SIGHLD, fixing a regression from commit v8.13-11-g80a1aca0d (2011) that caused timeout to fail to respond properly to child process termination signals.
• SIGALRM self-delivery: The patch adds logic to discard self-sent SIGALRM signals and rearm the handler, preventing race conditions where timeout's own alarm mechanism would interfere with user-specified --signal=ALRM.
• Hang condition resolved: Commit v8.26-39-g2f69dba5d (2017) had exacerbated the original bug so that -sCHLD caused timeout to hang upon child exit; the fix eliminates this deadlock path.
• Test coverage expansion: New test cases in tests/timeout/timeout.sh validate correct behavior for both signal types, addressing a gap that allowed the regression to persist for over a decade.
• Discovery provenance: The bug was identified by Anthropic's OSS Scanner as case ANT-2026-2EQL2L05, representing automated static or dynamic analysis of widely deployed C infrastructure code.

Why it matters

timeout(1) is embedded in countless shell scripts, CI pipelines, and system administration workflows across all Linux distributions and BSD systems, making this fix broadly relevant for operational reliability. The decade-long persistence of the bug illustrates how even heavily scrutinized core utilities can harbor subtle concurrency and signal-handling defects, and the involvement of Anthropic's scanning tool may signal growing automated scrutiny of foundational open-source C codebases by AI safety and security research organizations.