When an exiting task in the Linux kernel encounters an oops, the function that marks the task dead, do_task_dead, may be called with preemption still enabled. This violates a precondition that requires preemption to be disabled, causing the scheduler to incorrectly drop references on the task’s stack. Consequently, the stack of a terminated task can be reused by another process, leading to use‑after‑free or double‑free conditions that corrupt kernel memory. The flaw is triggered by an oops during task exit, such as in a file_operations::release handler, and maps to CWE-416 and CWE-787 weaknesses.

All Linux kernel versions lacking the preemption guard in do_task_dead are affected. The affected releases include all kernels prior to the commit that introduced the prevention of scheduling a TASK_DEAD task while preemption is enabled. This includes the development branches 7.1 rc1 through rc3 and other earlier stable branches that have not incorporated the fix.

The CVSS score of 7.8 indicates high severity. The EPSS score of <1% suggests a very low but nonzero probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker would need local context to trigger an oops in an exiting task, causing memory corruption that could lead to system crash, denial of service, or a foothold for privilege escalation. The overall risk remains significant in environments where vulnerable kernels are in use.