CVE-2026-46173

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

exit: prevent preemption of oopsing TASK_DEAD task

When an already-exiting task oopses, make_task_dead() currently calls

do_task_dead() with preemption enabled. That is forbidden:

do_task_dead() calls __schedule(), which has a comment saying "WARNING:

must be called with preemption disabled!".

If an oopsing task is preempted in do_task_dead(), between becoming

TASK_DEAD and entering the scheduler explicitly, bad things happen:

finish_task_switch() assumes that once the scheduler has switched away

from a TASK_DEAD task, the task can never run again and its stack is no

longer needed; but that assumption apparently doesn't hold if the dead

task was preempted (the SM_PREEMPT case).

This means that the scheduler ends up repeatedly dropping references on

the dead task's stack, which can lead to use-after-free or double-free

of the entire task stack; in other words, two tasks can end up running

on the same stack, resulti

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References