Kernel leaks parent thread's context to children
When creating a new thread, the kernel uses
context_save() followed by
context_set() to create the new thread's context. This results in the child thread inheriting a significant portion of the parent's context, including between different tasks, and from kernel to userspace.
Beyond the obvious security implications, having garbage in registers makes it harder to pass meaningful arguments from loader to the loaded program.