How to Understand and Eliminate Zombie Processes on Linux

In Linux, a program stored on disk becomes a process only after the CPU starts executing it. Each running instance is a process, and the system consists of many processes, including kernel (system) processes and user processes that run concurrently.

You can list all processes with the ps command and view the parent‑child relationship using pstree. Every process receives a unique PID; the first process started by the kernel has PID 1 and becomes the ancestor of all later processes.

What Is a Zombie Process?

When a child process terminates, the parent should call wait or waitpid to collect the child's exit status and release its resources. If the parent exits before the child, the child becomes an orphan and is adopted by the init process (PID 1), which then reaps it.

If the child exits while the parent is still running but the parent never calls wait, the child's PCB remains in the kernel as a zombie —a process that has finished execution but still occupies a slot in the process table.

How a Zombie Is Created – Example Code

The following C program demonstrates the creation of a zombie. The parent forks a child, then sleeps for 5 seconds. The child sleeps for 3 seconds, prints a message, and exits. Because the parent is still sleeping when the child exits, the child becomes a zombie.

#include <stdio.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/wait.h>

int main(void)
{
    pid_t pid;
    pid = fork();
    if (pid == 0) {
        printf("I am child, my parent= %d, going to sleep 3s
", getppid());
        sleep(3);
        printf("-------------child die--------------
");
    } else if (pid > 0) {
        printf("I am parent, pid = %d, myson = %d, going to sleep 5s
", getpid(), pid);
        sleep(5);
        system("ps -o pid,ppid,state,tty,command");
    } else {
        perror("fork");
        return 1;
    }
    return 0;
}

Running this program shows the child process disappearing from the process list while its entry remains as a zombie until the parent finally calls wait (or exits, allowing init to adopt it).

How to Remove a Zombie Process

Ordinary processes can be terminated with kill, pkill, or killall, which by default send the SIGTERM signal. However, a zombie is already dead; sending signals to it has no effect.

The only way to clean up a zombie is to have its parent reap it. If the parent is still alive but not calling wait, you can terminate the parent (except when the parent is PID 1). When the parent dies, the init process adopts the zombie and immediately reaps it, removing it from the process table.

Example: if PID 5878 is a zombie and its parent is PID 4809, you can eliminate the zombie by killing the parent:

$ sudo kill -9 4809  # 4809 is the parent, not the zombie

Be extremely careful when killing a parent process; terminating a process whose parent is PID 1 may cause the system to reboot.