Zombie and Orphan Processes

Introduction

Zombie and orphan processes come from the parent-child relationship between processes. The key idea is that a parent normally creates a child, and later collects the child's exit status using wait or an equivalent call.

A zombie appears when the child has already ended but the parent has not collected its status. An orphan appears when the parent exits while the child is still running.

Zombie Process

A zombie process is a terminated child process whose parent has not yet collected its exit status. The child is no longer running, but the kernel keeps a small record for the parent to read.

A zombie does not consume CPU because its execution has already finished. What remains is only the information needed for the parent-child handoff.

The kernel usually keeps:

• Process ID: The child can still be identified for status collection.

• Exit status: The parent can know how the child ended.

• Small kernel metadata: Required bookkeeping remains until the child is reaped.

The important memory line is: a zombie is dead but not reaped.

Why Zombies Exist

When a child process exits, the operating system cannot immediately delete every trace of it if the parent may still need the termination status. The parent may use that status to decide whether the child succeeded, failed, or ended abnormally.

So the kernel keeps limited information until the parent calls wait, waitpid, or an equivalent reaping mechanism. A few short-lived zombies are normal, but many uncollected zombies can waste process table entries and indicate a parent process bug.

Zombie Lifecycle

The basic flow is:

• Child runs normally: The child process performs its work.

• Child exits: It terminates using exit(status) or a similar path.

• Kernel stores status: The exit status is kept for the parent.

• Parent has not waited yet: The child becomes a zombie.

• Parent calls wait: The parent collects the status.

• Kernel cleans metadata: The zombie disappears.

Orphan Process

An orphan process is a child process whose parent exits while the child is still running. Unlike a zombie, an orphan is not dead; it continues executing.

When a process becomes orphaned, the operating system reparents it to a reaper process. Depending on the system, this may be init, PID 1, systemd, a subreaper, or another process responsible for collecting child statuses.

Later, when the orphan process exits, the reaper collects its status. This prevents the process from finishing without anyone responsible for reaping it.

Zombie vs Orphan Process

The main difference is the state of the child process.

So a zombie is waiting to be reaped, while an orphan is adopted so it can be reaped later when it exits.

Summary

A zombie process is a terminated child whose exit status has not yet been collected using wait or an equivalent call. It is dead but not reaped, so the kernel keeps its PID, exit status, and small metadata until cleanup is complete.

An orphan process is still running after its parent exits. The operating system adopts it under a reaper such as init, PID 1, systemd, or a subreaper, so its status can be collected when it eventually terminates.