Executive brief
A vulnerability in the Linux kernel could allow a local attacker to cause system instability or memory corruption. The issue occurs when a process that is already shutting down encounters a critical error (an 'oops'). If the system interrupts this process at a specific moment, it can lead to multiple parts of the system trying to use the same memory simultaneously, potentially crashing the server or allowing unauthorized modifications to system memory.
Technical details
A vulnerability exists in the Linux kernel's make_task_dead() function within kernel/exit.c. When a task that is already in the process of exiting encounters an 'oops', make_task_dead() calls do_task_dead() while preemption is still enabled. If the task is preempted after being marked TASK_DEAD but before the scheduler is explicitly invoked, the scheduler may prematurely release the task's stack. This results in a use-after-free or double-free condition where multiple tasks may attempt to use the same stack memory, leading to memory corruption. The fix involves explicitly disabling preemption before calling do_task_dead().
Affected products
- Linux Linux Kernel v5.15, v6.1, v6.6, v6.8, v6.9
Timeline
- 2026-05-11: patched: Initial patch authored by Jann Horn
- 2026-05-28: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165
- https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17
- https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34
- https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e
- https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891