I'm a bit shocked that the IRB gave an exemption letter - are they hoping that the kernel maintainers won't take the (very reasonable) step towards legal action?
I don't think any legal actions need to be taken. UMN can longer participate. Tough shit.
Is it illegal to intentionally create security risks?
I honestly do not know
Intentional misrepresentation that causes harm is commonly referred to as “fraud.”
I'd guess they may not have understood what actually happened, or were leaning heavily on the IEEE reviewers having no issues with the paper, as at that point it'd already been excepted.