CVE-2026-46173 Overview
CVE-2026-46173 is a Linux kernel vulnerability in the process exit path. When an already-exiting task triggers an oops, make_task_dead() calls do_task_dead() with preemption enabled. This violates the scheduler contract, since __schedule() must run with preemption disabled. If the oopsing task is preempted after being marked TASK_DEAD but before entering the scheduler, finish_task_switch() repeatedly drops references on the dead task's stack. The result is a use-after-free or double-free of the task stack, allowing two tasks to execute on the same stack and producing memory corruption.
Critical Impact
A single oops during task exit, including from a file_operations::release handler, can corrupt kernel memory and destabilize the system.
Affected Products
- Linux kernel (upstream stable branches receiving the referenced backports)
- Distributions shipping affected stable kernel versions
- Systems where an oops can occur during task exit handlers
Discovery Timeline
- 2026-05-28 - CVE-2026-46173 published to NVD
- 2026-05-28 - Last updated in NVD database
Technical Details for CVE-2026-46173
Vulnerability Analysis
The defect is a race in the kernel's task exit path that produces a use-after-free of the task stack. make_task_dead() is invoked when a task oopses while already exiting. It calls do_task_dead(), which transitions the task to TASK_DEAD and then calls __schedule() to relinquish the CPU permanently. The scheduler's __schedule() function requires preemption to be disabled by the caller.
Because make_task_dead() left preemption enabled, the oopsing task could be preempted in the narrow window between the TASK_DEAD transition and the explicit scheduler entry. finish_task_switch() treats any switch away from a TASK_DEAD task as terminal and releases the stack. When the preempted dead task is later rescheduled and switched away again, the stack reference is dropped a second time. Two tasks can then share the same stack memory, producing arbitrary kernel memory corruption.
Root Cause
The root cause is a missing preempt_disable() in make_task_dead() before the call to do_task_dead(). The exit path violated the scheduler's documented precondition that __schedule() must be entered with preemption disabled, opening a window for SM_PREEMPT handling to execute against a task whose state was already terminal.
Attack Vector
Triggering the condition requires a kernel oops during task exit. Any code path that can be reached from an exiting task qualifies, including file_operations::release handlers invoked when a process closes file descriptors. A local user able to provoke an oops in such a handler can reach the vulnerable window. The corruption is non-deterministic and depends on scheduler timing, but successful exploitation yields kernel memory corruption suitable for privilege escalation or denial of service.
No public exploit code is currently available. The fix is distributed across the following commits: Kernel Git Commit 640b4c00, Kernel Git Commit 6f49f94f, Kernel Git Commit 7b2800ba, Kernel Git Commit 9756b3db, and Kernel Git Commit c1fa0bb6.
Detection Methods for CVE-2026-46173
Indicators of Compromise
- Repeated kernel oops messages referencing make_task_dead, do_task_dead, or finish_task_switch in dmesg or /var/log/kern.log.
- KASAN reports identifying use-after-free or double-free of task_struct stack memory.
- Unexplained kernel panics during process exit, especially originating in driver release handlers.
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the stack use-after-free deterministically when the race occurs.
- Audit kernel logs centrally for oops signatures involving the exit path and correlate with process termination events.
- Track kernel version inventory against the upstream stable trees that include the referenced fix commits.
Monitoring Recommendations
- Forward kern.log and dmesg output to a central log store and alert on any oops or panic event.
- Monitor for unexpected host reboots and crash dumps on Linux endpoints and servers.
- Review custom and out-of-tree kernel modules with release callbacks for code that can call BUG() or panic().
How to Mitigate CVE-2026-46173
Immediate Actions Required
- Apply the latest stable Linux kernel update from your distribution vendor that includes the referenced commits.
- Reboot affected systems after patching to load the corrected kernel image.
- Inventory all running kernels across servers, workstations, and container hosts to confirm none remain on vulnerable versions.
Patch Information
The upstream fix disables preemption in make_task_dead() before invoking do_task_dead(), preserving the scheduler's precondition. The change has been backported across multiple stable branches. Reference the commits listed in the Technical Details section to confirm the fix is present in your kernel source.
Workarounds
- No reliable runtime workaround exists. Patching is the only supported remediation.
- Reduce exposure by restricting local user access on multi-tenant hosts until kernels are updated.
- Disable or remove third-party kernel modules with known instability in release handlers where feasible.
# Verify the running kernel and confirm the patch commit is included
uname -r
zcat /proc/config.gz 2>/dev/null | grep -E 'CONFIG_KASAN|CONFIG_PREEMPT'
git -C /usr/src/linux log --oneline | grep -E '640b4c00|6f49f94f|7b2800ba|9756b3db|c1fa0bb6'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
