All vulnerabilities
CVE-2026-99103

Linux: workqueue: Fix unbound pool lifetime for pending pwqs

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in6741dd3fd38e47c08bc39d11ef5fa141fa6d0441Also 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849, 3d2ef2b9f4c084ab498494d26495a82f7e15407b and 3 moreCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq():

BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK>

Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450

Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610

Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790

Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock.

Remove the pwq from pending_pwqs before putting the pool.

Text from CVE List

Affected versions 16

  • Linuxaffected: 5a70baec2294e8a7d0fcc4558741c23e752dad5c before 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441CVE List
  • Linuxaffected: 843288afd3cc6f3342659c6cf81fc47684d25563 before 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849CVE List
  • Linuxaffected: 5797b1c18919cd9c289ded7954383e499f729ce0 before f320b85c90fe5fc9d4d06badd450518323a94a7fCVE List
  • Linuxaffected: 5797b1c18919cd9c289ded7954383e499f729ce0 before 3d2ef2b9f4c084ab498494d26495a82f7e15407bCVE List
  • Linuxaffected: 5797b1c18919cd9c289ded7954383e499f729ce0 before cf9c8aaea0d47410df8708bec195889f3a85cd3cCVE List
  • Linuxaffected: fc67aebe34f22632ccb22faea48cc4d3134620a2CVE List
  • Linuxaffected: 6.6.23 before 6.6.25CVE List
  • Linuxaffected: 6.8.2 before 6.8.4CVE List
  • Linuxaffected: 6.7.11 before 6.8CVE List
  • Linuxaffected: 6.9CVE List
  • Linuxunaffected: all versions before 6.9CVE List
  • Linuxunaffected: 6.6.25 through 6.6.*CVE List
  • Linuxunaffected: 6.8.4 through 6.8.*CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5