{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-46173", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.103Z", "datePublished": "2026-05-28T09:36:27.892Z", "dateUpdated": "2026-08-05T12:30:11.089Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:30:11.089Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nexit: prevent preemption of oopsing TASK_DEAD task\n\nWhen an already-exiting task oopses, make_task_dead() currently calls\ndo_task_dead() with preemption enabled. That is forbidden:\ndo_task_dead() calls __schedule(), which has a comment saying \"WARNING:\nmust be called with preemption disabled!\".\n\nIf an oopsing task is preempted in do_task_dead(), between becoming\nTASK_DEAD and entering the scheduler explicitly, bad things happen:\nfinish_task_switch() assumes that once the scheduler has switched away\nfrom a TASK_DEAD task, the task can never run again and its stack is no\nlonger needed; but that assumption apparently doesn't hold if the dead\ntask was preempted (the SM_PREEMPT case).\n\nThis means that the scheduler ends up repeatedly dropping references on\nthe dead task's stack, which can lead to use-after-free or double-free\nof the entire task stack; in other words, two tasks can end up running\non the same stack, resulting in various kinds of memory corruption.\n\n(This does not just affect \"recursively oopsing\" tasks; it is enough to\noops once during task exit, for example in a file_operations::release\nhandler)" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is in the kernel task-exit/scheduler path (`make_task_dead` → `do_task_dead`) of a local process; it is triggered by a task oopsing during its own exit, with no remote network reachability.\nAC:L - Exploitation depends on a preemption-timing window between `set_special_state(TASK_DEAD)` and `__schedule()`, but the attacker can repeatedly spawn exiting+faulting tasks and generate CPU load to induce preemption, making the race winnable; per the uncertainty rule the higher-severity value is chosen.\nPR:L - Any unprivileged local user can spawn processes that exit and fault on the exit path; no real-root or init-namespace privilege is required.\nUI:N - The attacker triggers their own process exit and fault; no action by another user is needed.\nS:U - The use-after-free/double-free corrupts kernel task-stack memory within the kernel's own security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The double-free/UAF of the task stack lets two tasks run on the same stack, giving the attacker control over freed memory contents and thus an arbitrary kernel-memory read primitive.\nI:H - The same task-stack UAF/double-free yields an arbitrary write / control-flow-hijack primitive (heap spray, overlapping stacks), enabling privilege escalation.\nA:H - The repeated reference drops cause double-free/use-after-free memory corruption that reliably leads to kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/exit.c" ], "versions": [ { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "3d6fb8a7690c23e3213c4b008f64d89a44b98737", "status": "affected", "versionType": "git" }, { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "640b4c00fb0e2920327435f6176cbefc3c546165", "status": "affected", "versionType": "git" }, { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34", "status": "affected", "versionType": "git" }, { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "6f49f94f3b11fe8bff1bf2a054143789e76aaf17", "status": "affected", "versionType": "git" }, { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "9756b3db5db6c2f5eccb32dddbd88eb4c54f575e", "status": "affected", "versionType": "git" }, { "version": "7f80a2fd7db9a55894fd841915236aca611291b5", "lessThan": "c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "kernel/exit.c" ], "versions": [ { "version": "5.17", "status": "affected" }, { "version": "0", "lessThan": "5.17", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.6.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.12.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "6.18.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.0.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.17", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/3d6fb8a7690c23e3213c4b008f64d89a44b98737" }, { "url": "https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165" }, { "url": "https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34" }, { "url": "https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17" }, { "url": "https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e" }, { "url": "https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891" }, { "url": "https://project-zero.issues.chromium.org/issues/510793286" } ], "title": "exit: prevent preemption of oopsing TASK_DEAD task", "x_generator": { "engine": "bippy-1.2.0" } } } }