The Linux kernel memory control group contains a flaw that allows dying tasks to bypass the ordinary out‑of‑memory (OOM) cleanup path. When a process is killed by the OOM killer, the kernel attempts to reclaim or free its memory asynchronously. If the OOM reaper cannot acquire the necessary mmap lock, it sets an OOM skip flag and abandons the cleanup, causing the task’s exit path to spend excessive time waiting for a lock held by other threads. The result is a denial‑of‑service scenario in which a large number of processes, often thousands, become stuck in exit for long periods, consuming system resources and preventing normal shutdown. This issue arises from improper handling of the oom_lock during process termination and is related to CWE‑399: Resource Management Errors.

The vulnerability affects the Linux kernel across all releases that do not include the commit a75ffa26122b, which was introduced in the 2026‑07‑28 test kernel. All Linux kernel versions lacking this commit are potentially impacted. No specific kernel version is listed in the advisory, so the issue is assumed to exist in earlier kernels that lack the patch.

There is no EPSS score available, and the vulnerability is not listed in the CISA KEV catalog, indicating that exploit evidence is presently unknown or unquantified. No CVSS score is provided in the advisory. The likely attack vector is local: an attacker who can spawn or influence large‑memory‑limited processes, such as by exploiting a userland application, may trigger the bug. Exploitation requires the kernel to be in a state where a process is OOM‑killed and the OOM reaper has set the MMF_OOM_SKIP flag, leading to a long exit path for many threads. Because the bug manifests during normal OOM cleanup, it may be difficult to reliably trigger, so the likelihood of exploitation in the wild is moderate, but a successful exploitation would result in a severe denial of service.