Linux Kernel EUVD-2026-40961

The vulnerability resides in the debugobjects subsystem (kernel/debugobjects.c) of the Linux kernel. On PREEMPT_RT (Real-Time preemption) kernels, traditional spinlocks are replaced with rtlocks - real-time-aware locks that support priority inheritance (PI). When fill_pool() attempts to acquire such an rtlock via rtlock_lock(), the kernel asserts that the calling task's pi_blocked_on pointer is NULL, because a task can only participate in one priority inheritance chain at a time. If fill_pool() is invoked from a context where pi_blocked_on is already non-NULL (the task is already blocked waiting on another PI-lock), the assertion fires and causes a kernel panic. The root cause is a missing guard in the fill_pool() call path that fails to check this PI state before entering the lock path. CWE was not assigned by NVD; the closest applicable class is CWE-617 (Reachable Assertion) or CWE-667 (Improper Locking). CPE confirms the affected product as cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* covering kernel versions from commit 4bedcc28469a24fe481a8a31b3584e6070457ddb onward until the respective stable-branch fix commits.