Understanding Linux Zombie Processes: Causes, Risks, and How to Eliminate Them

What Is a Zombie Process?

When a child process terminates, the Linux kernel retains a small descriptor containing the child’s PID, exit status and CPU time until the parent calls wait() or waitpid(). This retained state is called a zombie process . The kernel keeps the descriptor so the parent can retrieve the termination information.

How a Zombie Is Created

If a parent forks a child, the child exits, and the parent neither exits nor invokes wait(), the child remains in the zombie state. The following program deliberately creates such a situation:

#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    int i = 100;
    pid_t pid = fork();
    if (pid < 0) {
        perror("fork failed.");
        exit(1);
    }
    if (pid > 0) {
        printf("This is the parent process. My PID is %d.
", getpid());
        for (; i > 0; i--) {
            sleep(1);
        }
    } else {
        printf("This is the child process. My PID is %d. My PPID is %d.
", getpid(), getppid());
    }
    return 0;
}

Compile and run:

gcc zomprocdemo.c -o zomprocdemo
./zomprocdemo

After the child exits, the parent continues sleeping. Using ps you will see the child listed with a capital “Z” in the STAT column, indicating a zombie:

Why Zombies Are Harmful

The kernel releases most resources of a terminated process, but it keeps the PID and exit information until the parent reaps it. If many zombies accumulate, they consume the limited PID space, eventually preventing the creation of new processes.

Properly Cleaning Up Zombies

The parent should call wait() (or waitpid()) after forking. The example below demonstrates a parent that waits for its child and extracts the child’s exit code with the WEXITSTATUS macro:

#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    pid_t pid = fork();
    if (pid < 0) {
        perror("fork failed");
        exit(1);
    }
    if (pid == 0) {
        for (int i = 3; i > 0; i--) {
            printf("This is the child
");
            sleep(1);
        }
        exit(3); // exit with code 3 for testing
    } else {
        int stat_val;
        wait(&stat_val);
        if (WIFEXITED(stat_val)) {
            printf("Child exited with code %d
", WEXITSTATUS(stat_val));
        }
    }
    return 0;
}

Running this program shows that the parent successfully reaps the child, so no zombie appears.

Dealing With Existing Zombies

A zombie cannot be killed directly with kill. The usual remedy is to terminate its parent process; the zombie becomes an orphan and is adopted by the system’s init process (or systemd / upstart). The init process will then reap the zombie and free its PID.