/glossary/coreutils/zombie-process
What is a zombie process (defunct) in Linux?
The commands on this page have not been executed by our verification runner yet.updated 2026-10-20
- tool
- GNU coreutils
- versions
- Linux
- os
- linux, macos
A zombie process has finished running, but its entry stays in the process table because the parent has not yet collected its exit status with wait() or waitpid(). It uses no CPU or memory beyond that entry. ps shows it with state Z and the label <defunct>.
Find zombies
ps -eo pid,ppid,stat,cmd | awk '$3 ~ /^Z/'The PPID column names the parent that should reap it.
Get rid of them
- A zombie cannot be killed: it is already dead.
kill -9on the zombie does nothing. - Make the parent call
wait(), for example by sending itSIGCHLD, or fix the bug in the parent. - If the parent exits, its children are adopted by
init(PID 1) or the nearest subreaper, which reaps them.
Why it matters
A few zombies are harmless. Thousands of them can exhaust the process ID space, so new processes fail to start. In containers this often happens when the main process is not an init system and never reaps children; running the container with an init (for example docker run --init) fixes it.
Sources
Related pages
codes · coreutilsLinux signals: numbers, names and default actionsLinux signal numbers on x86 and ARM: SIGHUP 1, SIGINT 2, SIGKILL 9, SIGTERM 15, SIGCHLD 17, SIGSTOP 19, with their default action and the exit code 128+n.codes · bashBash exit codes: 0, 1, 2, 126, 127, 128+n and 255What bash exit codes mean: 0 success, 1 general error, 2 misuse of builtins, 126 not executable, 127 not found, 128+n killed by signal n, and how to read $?.cheat sheets · awkawk cheat sheet: fields, patterns, sums and printfawk cheat sheet: print fields, change the separator, filter rows by pattern or condition, sum and count columns, use BEGIN and END, printf formats and arrays.