All vulnerabilities
CVE-2026-99058

Linux: workqueue: Fix NULL current_pwq deref in chained work check

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in3dc61af2998cfc7312d6e59bbdcd5eed074483f2Also 729d576df89c7e4341e58c452f8890620a610ac2, 1a2668682e998039a027796b236319b380078a6a and 1 moreCVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 3dc61af2998cfc7312d6e59bbdcd5eed074483f2LinuxCVE List
  • 729d576df89c7e4341e58c452f8890620a610ac2LinuxCVE List
  • 1a2668682e998039a027796b236319b380078a6aLinuxCVE List
  • 980db94e3eeefdd8a1c46f86412c33a7f7806f51LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in chained work check

current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function.

is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning.

Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.

Text from CVE List

Affected versions 12

  • Linuxaffected: 8d03ecfe471802d6afe97da97722b6924533aa82 before 3dc61af2998cfc7312d6e59bbdcd5eed074483f2CVE List
  • Linuxaffected: 8d03ecfe471802d6afe97da97722b6924533aa82 before 729d576df89c7e4341e58c452f8890620a610ac2CVE List
  • Linuxaffected: 8d03ecfe471802d6afe97da97722b6924533aa82 before b12a25fb2b9d5dac80e419d695450cc17a51fdfdCVE List
  • Linuxaffected: 8d03ecfe471802d6afe97da97722b6924533aa82 before 1a2668682e998039a027796b236319b380078a6aCVE List
  • Linuxaffected: 8d03ecfe471802d6afe97da97722b6924533aa82 before 980db94e3eeefdd8a1c46f86412c33a7f7806f51CVE List
  • Linuxaffected: 3.9CVE List
  • Linuxunaffected: all versions before 3.9CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.57 through 6.18.*CVE List
  • Linuxunaffected: 7.2.11 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5