# CVE-2026-46173: exit: prevent preemption of oopsing TASK_DEAD task

Status: published. Published: 2026-05-28. Updated: 2026-11-10.

In the Linux kernel, the following vulnerability has been resolved:

exit: prevent preemption of oopsing TASK_DEAD task

When an already-exiting task oopses, make_task_dead() currently calls
do_task_dead() with preemption enabled.  That is forbidden:
do_task_dead() calls __schedule(), which has a comment saying "WARNING:
must be called with preemption disabled!".

If an oopsing task is preempted in do_task_dead(), between becoming
TASK_DEAD and entering the scheduler explicitly, bad things happen:
finish_task_switch() assumes that once the scheduler has switched away
from a TASK_DEAD task, the task can never run again and its stack is no
longer needed; but that assumption apparently doesn't hold if the dead
task was preempted (the SM_PREEMPT case).

This means that the scheduler ends up repeatedly dropping references on
the dead task's stack, which can lead to use-after-free or double-free
of the entire task stack; in other words, two tasks can end up running
on the same stack, resulting in various kinds of memory corruption.

(This does not just affect "recursively oopsing" tasks; it is enough to
oops once during task exit, for example in a file_operations::release
handler)

## Remediation

No remediation reported in collected sources

## Affected products and versions

- Linux / Linux: ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < 3d6fb8a7690c23e3213c4b008f64d89a44b98737 (affected, git); ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < 640b4c00fb0e2920327435f6176cbefc3c546165 (affected, git); ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < 7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34 (affected, git); ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < 6f49f94f3b11fe8bff1bf2a054143789e76aaf17 (affected, git); ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < 9756b3db5db6c2f5eccb32dddbd88eb4c54f575e (affected, git); ≥ 7f80a2fd7db9a55894fd841915236aca611291b5; < c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 (affected, git). Source: CNA: Linux
- Linux / Linux: 5.17 (affected); ≥ 0; < 5.17 (unaffected, semver); ≥ 6.1.175; ≤ 6.1.* (unaffected, semver); ≥ 6.6.140; ≤ 6.6.* (unaffected, semver); ≥ 6.12.88; ≤ 6.12.* (unaffected, semver); ≥ 6.18.30; ≤ 6.18.* (unaffected, semver); ≥ 7.0.7; ≤ 7.0.* (unaffected, semver); ≥ 7.1; ≤ * (unaffected, original_commit_for_fix). Source: CNA: Linux
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0): ≥ V3.1.6; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0): ≥ V3.1.7; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0): ≥ V3.1.6; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0): ≥ V3.1.7; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0): ≥ V3.1.6; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0): ≥ V3.1.7; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0): ≥ V3.1.6; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0): ≥ V3.1.7; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIMATIC S7-1500 TM MFP - GNU/Linux subsystem: ≥ 0; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0): ≥ V3.1.6; < * (affected, custom). Source: ADP: siemens-SADP
- Siemens / SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0): ≥ V3.1.7; < * (affected, custom). Source: ADP: siemens-SADP

## Severity and prioritization

- CVSS 3.1: 7.8 (high); CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H; source: CNA: Linux

- CISA KEV: No listing in collected sources

- EPSS: 0.13% as of 2026-11-09; percentile 2.77%

- SSVC: exploitation none; automatable no; technical impact total; source ADP: CISA-ADP

- Weaknesses: CWE-416

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://git.kernel.org/stable/c/3d6fb8a7690c23e3213c4b008f64d89a44b98737 (CNA: Linux)

- https://git.kernel.org/stable/c/640b4c00fb0e2920327435f6176cbefc3c546165 (CNA: Linux)

- https://git.kernel.org/stable/c/7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34 (CNA: Linux)

- https://git.kernel.org/stable/c/6f49f94f3b11fe8bff1bf2a054143789e76aaf17 (CNA: Linux)

- https://git.kernel.org/stable/c/9756b3db5db6c2f5eccb32dddbd88eb4c54f575e (CNA: Linux)

- https://git.kernel.org/stable/c/c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891 (CNA: Linux)

- https://project-zero.issues.chromium.org/issues/510793286 (CNA: Linux)

- https://cert-portal.siemens.com/productcert/html/ssa-019113.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-457936.html (ADP: siemens-SADP)

- https://cert-portal.siemens.com/productcert/html/ssa-784472.html (ADP: siemens-SADP)

## Provenance

- CNA: Linux: https://www.cve.org/CVERecord?id=CVE-2026-46173; retrieved 2026-11-10; source updated 2026-11-10

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-46173; retrieved 2026-11-10; source updated Not reported

Revision: 64addccc8c72446a70d0db1aaa6647ea6daa41ce4437138d165fc576abb6d894

Canonical: https://y2.dev/cve/CVE-2026-46173

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.