PT-2026-44296 · Linux · Linux

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46173

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

exit: prevent preemption of oopsing TASK DEAD task

When an already-exiting task oopses, make task dead() currently calls do task dead() with preemption enabled. That is forbidden: do task dead() calls schedule(), which has a comment saying "WARNING: must be called with preemption disabled!".

If an oopsing task is preempted in do task dead(), between becoming TASK DEAD and entering the scheduler explicitly, bad things happen: finish task switch() assumes that once the scheduler has switched away from a TASK DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM PREEMPT case).

This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption.

(This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file operations::release handler)

Fix

Related Identifiers

CVE-2026-46173

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46173 · Security Note
• https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34 · Note
• https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165 · Note
• https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17 · Note
• https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 · Note
• https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e · Note