# GNU Coreutils fixes timeout --kill-after deadlock with blocked --verbose output

> **Key takeaway:** A signal-handling bug in timeout could prevent --kill-after from executing when --verbose output was blocked, now fixed with SIGALRM unblocking during diagnostics.

**Published:** 2026-10-27T23:15:30+00:00 
**Source:** GNU Coreutils Releases & Commits 
**Category:** system-core 
**Canonical URL:** https://fosswire.org/news/gnu-coreutils-fixes-timeout-kill-after-deadlock-with-blocked.html 

## Summary
GNU Coreutils has patched a bug in the timeout utility where the --kill-after option could fail to terminate a process if --verbose diagnostic output was blocked. The fix, discovered by Anthropic's OSS Scanner and tracked as bug ANT-2026-GV4Z4T3T, ensures that SIGALRM is unblocked during cleanup diagnostics so that an armed kill-after timer is properly honored. The change affects the cleanup() function in src/timeout.c and includes a new regression test in tests/timeout/timeout.sh. This resolves a subtle but serious reliability issue for scripts and automation that depend on timeout's hard-kill guarantees.

The bug manifested when timeout attempted to print verbose diagnostic messages while SIGALRM was blocked, causing the pending alarm signal to be delayed or missed entirely. By temporarily unblocking SIGALRM during diagnostic output, the utility now maintains its contract to deliver the SIGKILL after the specified grace period. The NEWS file was also updated to clarify that using -k without -f is now resilient to blocking scenarios.

## Signal handling and timeout reliability fixes
- **SIGALRM unblocking in cleanup():** The cleanup() function in src/timeout.c now unblocks SIGALRM before emitting diagnostic messages, ensuring that a pending --kill-after alarm is not masked by blocked signals during verbose output.
- **-k without -f resilience:** The fix specifically addresses cases where --kill-after (-k) is used without --foreground (-f), making this combination robust against blocking conditions that previously could stall termination.
- **Regression test coverage:** A new test case in tests/timeout/timeout.sh validates the fix and prevents future regressions in signal-handling behavior.
- **External discovery and tracking:** The vulnerability was identified by Anthropic's OSS Scanner and assigned identifier ANT-2026-GV4Z4T3T, indicating automated static analysis of widely deployed system utilities.

## Why it matters
System administrators and DevOps engineers who rely on timeout for process lifecycle management in shell scripts, CI pipelines, and container health checks gain stronger guarantees that hard-kill deadlines will be enforced even under edge-case signal conditions. This fix reduces the risk of hung processes escaping timeout boundaries, which can cascade into resource exhaustion or failed orchestration workflows in production Linux environments.