Heimdall Security Logo

CVE-2026-46173

Vulnérabilité élevée dans Linux (Linux)

CVSS 7.8 · Élevée
EPSS 0.2%
Linux•Linux•Versions : <=6.1.*, 7.0.7, <=7.0.*, <=6.12.*, <c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891, 7f80a2fd7db9a55894fd841915236aca611291b5, <640b4c00fb0e2920327435f6176cbefc3c546165, 0, <7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34, <5.17, 6.12.88, <=6.6.*, 6.1.175, <9756b3db5db6c2f5eccb32dddbd88eb4c54f575e, <6f49f94f3b11fe8bff1bf2a054143789e76aaf17, 7.1, <3d6fb8a7690c23e3213c4b008f64d89a44b98737, <=6.18.*, <=*, 6.6.140, 6.18.30, 5.17

Description

In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption disabled!". If an oopsing task is preempted in do_task_dead(), between becoming TASK_DEAD and entering the scheduler explicitly, bad things happen: finish_task_switch() assumes that once the scheduler has switched away from a TASK_DEAD task, the task can never run again and its stack is no longer needed; but that assumption apparently doesn't hold if the dead task was preempted (the SM_PREEMPT case). This means that the scheduler ends up repeatedly dropping references on the dead task's stack, which can lead to use-after-free or double-free of the entire task stack; in other words, two tasks can end up running on the same stack, resulting in various kinds of memory corruption. (This does not just affect "recursively oopsing" tasks; it is enough to oops once during task exit, for example in a file_operations::release handler)

Gravité et risque d'exploitation

CVE-2026-46173 obtient un score CVSS de 7.8/10, soit une gravité élevée. Selon le modèle EPSS, la probabilité qu'elle soit exploitée dans les 30 prochains jours est de 0.18 %, ce qui la place devant 7.0 % des CVE référencées.

Que faire ?

  • Vérifiez si Linux (versions <=6.1.*, 7.0.7, <=7.0.*, <=6.12.*, <c1fa0bb633e4a6b11e83ffc57fa5abe8ebb87891, 7f80a2fd7db9a55894fd841915236aca611291b5, <640b4c00fb0e2920327435f6176cbefc3c546165, 0, <7b2800ba5f5f77a8ee7f4cbadb19cf1264597a34, <5.17, 6.12.88, <=6.6.*, 6.1.175, <9756b3db5db6c2f5eccb32dddbd88eb4c54f575e, <6f49f94f3b11fe8bff1bf2a054143789e76aaf17, 7.1, <3d6fb8a7690c23e3213c4b008f64d89a44b98737, <=6.18.*, <=*, 6.6.140, 6.18.30, 5.17) est présent sur votre parc.
  • Appliquez le correctif ou la version corrigée indiqués dans les références de l'éditeur.
  • À défaut de correctif, limitez l'exposition (filtrage réseau, désactivation du composant).
  • Automatisez la détection : les agents CVE Heimdall (gratuits, open source) corrèlent l'inventaire de vos serveurs avec la base CVE.

Références

Rechercher une autre CVE