When an exiting task in the Linux kernel encounters an oops, the function that marks the task dead, do_task_dead, may be executed with preemption still enabled. This violates a precondition that requires preemption to be disabled, causing the scheduler to incorrectly drop references on the task’s stack. Consequently, the stack of a terminated task can be used by another process, leading to use‑after‑free or double‑free conditions that corrupt kernel memory and can cause a system crash. The flaw is triggered by an oops during task exit, such as in a file_operations::release handler, and does not require recursive oops situations. This issue maps to CWE‑787, highlighting a use‑after‑free weakness.

All Linux kernel versions that contain the unpatched do_task_dead implementation are vulnerable. The exact range of affected releases is not specified, but any kernel prior to the commit that introduced the preemption guard is susceptible.

The CVSS score of 7.8 indicates high severity. The EPSS score of <1% suggests a very low but nonzero probability of exploitation, and the issue is not listed in the CISA KEV catalog. The flaw appears, based on the description, to be exploitable only in a local context, requiring an attacker who can trigger an oops in an exiting task. Because the memory corruption affects kernel memory, it could potentially lead to a system crash or severe instability. The risk remains significant given severity, but further assessment is required to determine the exact impact in various environments.