Linux Zombie Process — What It Is and How to Remove It

What Does This Error Mean?

A zombie process in Linux is a process that has finished running but is still listed in the process table because its parent process has not collected its exit status. Zombie processes appear as 'Z' or 'defunct' in the top or ps command output. A few zombies are harmless — they consume almost no resources. However, a large accumulation of zombies can exhaust the process table and prevent new processes from starting.

Affected Models

Ubuntu
Debian
Fedora
CentOS
Arch Linux
Linux Mint
openSUSE

Common Causes

The parent process of a child process is not properly calling wait() to collect the exit status
A software bug in the parent application is causing it to ignore child process terminations
The parent process itself has crashed or hung, leaving all its child processes as zombies
A poorly written shell script is spawning background jobs without properly managing them
System load is so high that the parent process cannot process child exit signals in time

How to Fix It

Check for zombie processes. Type: ps aux | grep Z — or in top, press Shift + Z to highlight zombies. Note how many there are and which parent process (PPID) they belong to.

One or two zombie processes are normal and not worth worrying about. Only take action if there are many, or if new processes cannot be started.
Find the parent of the zombie processes. Type: ps -o ppid= -p [zombie-pid] — then find out which program has that parent PID: ps -p [ppid] -o comm=

The parent process is responsible for the zombies. Fixing or restarting the parent is the correct way to clean up its zombie children.
Send SIGCHLD to the parent process. Type: sudo kill -s SIGCHLD [parent-pid] — this signal tells the parent to check for finished child processes and collect their exit status.

This sometimes prompts a buggy parent to clean up its zombies without needing a full restart. Try this before restarting the parent.
Restart the parent process if SIGCHLD does not work. Type: sudo systemctl restart [service-name] (if it is a service) or use: kill [parent-pid] to stop the parent. All its zombie children are cleaned up when the parent exits.

When a parent process exits, its zombie children are adopted by init (PID 1), which immediately reaps them. Restarting the buggy parent is often the simplest effective fix.
Reboot as a last resort. If zombie accumulation is critical and you cannot identify the parent, a system reboot clears all zombies and allows you to investigate the root cause after restarting.

A reboot always clears zombies. Schedule it during a maintenance window if this is a server.

When to Call a Professional

Small numbers of zombie processes are normal and harmless. If you see hundreds or thousands of zombie processes, the parent application has a bug. Contact the software vendor if it is a commercial application, or report it as a bug if it is open source.

Frequently Asked Questions

Can I kill a zombie process directly?

No — zombie processes are already dead. They are just entries in the process table waiting to be collected. You cannot kill something that is already finished. The only way to remove a zombie is for its parent to call wait() and collect the exit status, or for the parent to exit (at which point init cleans up the zombie automatically).

Are zombie processes dangerous?

A small number of zombie processes are completely harmless. They consume virtually no memory or CPU — they are just a row in a table. They only become a problem if they accumulate in large numbers (thousands) and exhaust the maximum process table size. If that happens, the system cannot create any new processes — not even login shells.

How do I prevent zombie processes in my own scripts?

If you write shell scripts or programs that spawn child processes, always wait for them to finish. In bash scripts, use the 'wait' command after background jobs. In Python, use subprocess with proper cleanup or the concurrent.futures module which handles this automatically. In C, register a SIGCHLD signal handler that calls waitpid() to reap finished children.