High 7.8Published May 28, 2026

CVE-2026-46173exit: prevent preemption of oopsing TASK_DEAD task

Updated under an hour ago (Oct 28, 2026, 8:00 AM ET)

Does this affect you?

It affects Linux and 5 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption disabled!". If an oopsing task is preempted in do_task_dead(), between becoming TASK_DEAD and entering the scheduler explicitly, bad things happen: finish_task_switch() assumes that once the scheduler has switched away from a TASK_DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM_PREEMPT case). This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption. (This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file_operations::release handler)

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	7f80a2fd7db9a55894fd841915236aca611291b5 builds before 3d6fb8a7690c23e3213c4b008f64d89a44b98737; from 7f80a2fd7db9a55894fd841915236aca611291b5 before 640b4c00fb0e2920327435f6176cbefc3c546165; 7f80a2fd7db9a55894fd841915236aca611291b5 builds before 7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34; 7f80a2fd7db9a55894fd841915236aca611291b5 builds before 6f49f94f3b11fe8bff1bf2a054143789e76aaf17; from 7f80a2fd7db9a55894fd841915236aca611291b5 before 9756b3db5db6c2f5eccb32dddbd88eb4c54f575e; from 7f80a2fd7db9a55894fd841915236aca611291b5 before c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 5.17 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; 7.1; 7.1; 7.1	NVD

References

References

https://git.kernel.org/stable/c/3d6fb8a7690c23e3213c4b008f64d89a44b98737	patch
https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165	patch
https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34	patch
https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17	patch
https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e	patch
https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891	patch
https://project-zero.issues.chromium.org/issues/510793286
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-457936.html
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.