Fundamentals 5 min read

Why Do Zombie Processes Linger After Exit? Understanding Linux’s Hidden State

This article explains how zombie processes remain in the Linux process table after a program calls exit, what information they retain, why they cannot be killed directly, and how to properly reap them using wait or waitpid.

MaGe Linux Operations
MaGe Linux Operations
MaGe Linux Operations
Why Do Zombie Processes Linger After Exit? Understanding Linux’s Hidden State

Few people realize that after a process calls exit, it does not disappear immediately; instead, the kernel keeps a data structure called a zombie process.

Among the five Linux process states, a zombie is special: it has released almost all memory, has no executable code, and cannot be scheduled. It only occupies a slot in the process list to store the exit status and other information for the parent to collect, without using any additional memory.

The concept dates back to Unix and was not created just for show. The zombie retains crucial details such as how the process terminated (normal exit, error, or forced termination), the exit code, total CPU time (system and user), page faults, and signals received. Without zombies, this information would be lost as soon as the process exits, leaving parents or administrators unable to diagnose issues.

When a process exits, its state becomes Zombie and the kernel waits for the parent to retrieve the exit information. If the parent is busy, the zombie remains until the parent calls wait or waitpid, or until the kernel eventually cleans it up after the parent terminates.

Zombie processes cannot be removed with kill because they have already exited; to eliminate them you must either terminate the parent process or wait for the kernel to reap them. Accumulating zombies consumes PID numbers, which can hinder process scheduling.

Example:

#include <sys/types.h>
#include <unistd.h>
int main() {
    pid_t pid;
    pid = fork();
    if (pid < 0) {
        printf("error occurred!
");
    } else if (pid == 0) {
        exit(0);
    } else {
        sleep(60);
        wait(NULL);
    }
    return 0;
}

Compile and run:

$ cc zombie.c -o zombie
$ ./zombie &
[1] 1217
$ ps -ax
... 
1217   pts/0   S   0:00 ./zombie
1218   pts/0   Z   0:00 [zombie]

The “Z” flag indicates a zombie process. To collect its information and fully terminate it, the parent must invoke waitpid or wait.

Source: https://coolshell.cn/articles/656.html
Original Source

Signed-in readers can open the original source through BestHub's protected redirect.

Sign in to view source
Republication Notice

This article has been distilled and summarized from source material, then republished for learning and reference. If you believe it infringes your rights, please contactadmin@besthub.devand we will review it promptly.

process managementzombie processwaitpid
MaGe Linux Operations
Written by

MaGe Linux Operations

Founded in 2009, MaGe Education is a top Chinese high‑end IT training brand. Its graduates earn 12K+ RMB salaries, and the school has trained tens of thousands of students. It offers high‑pay courses in Linux cloud operations, Python full‑stack, automation, data analysis, AI, and Go high‑concurrency architecture. Thanks to quality courses and a solid reputation, it has talent partnerships with numerous internet firms.

0 followers
Reader feedback

How this landed with the community

Sign in to like

Rate this article

Was this worth your time?

Sign in to rate
Discussion

0 Comments

Thoughtful readers leave field notes, pushback, and hard-won operational detail here.