CVE-2026-98537 - Vulnerability Details

- workqueue: Fix NULL current_pwq deref in flush dependency check

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in flush dependency check

check_flush_dependency() uses current_wq_worker() to determine whether
the caller is a workqueue worker and then dereferences worker->current_pwq
to test whether the current workqueue is WQ_MEM_RECLAIM.

current_wq_worker() only means that %current has PF_WQ_WORKER set. A
kworker can reach check_flush_dependency() while it is not executing a
work item. One such path is worker_thread() acting as the pool manager,
where create_worker() does GFP_KERNEL allocation and the allocation path
invokes the OOM notifier. In that state worker->current_pwq is NULL
because current_pwq is set only by process_one_work() and cleared again
after the work function returns.

[ 416.760634][ T375] Call trace:
[ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P)
[ 416.760648][ T375] __flush_work+0x98/0x224
[ 416.760657][ T375] flush_work+0x30/0x44
[ 416.760665][ T375] ...
[ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0
[ 416.760719][ T375] out_of_memory+0xb4/0x458
[ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8
[ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c
[ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4
[ 416.760753][ T375] new_slab+0x12c/0x484
[ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c
[ 416.760765][ T375] __slab_alloc+0x74/0xd8
[ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304
[ 416.760779][ T375] alloc_worker+0x28/0x60
[ 416.760785][ T375] create_worker+0x4c/0x20c
[ 416.760790][ T375] worker_thread+0xe8/0x2b8
[ 416.760796][ T375] kthread+0x1a8/0x200
[ 416.760805][ T375] ret_from_fork+0x10/0x20

Guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the
kworker is not currently executing a work item, there is no current
workqueue to diagnose with that warning. The PF_MEMALLOC warning is left
unchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target
is still reported.

Published: 2026-10-18

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a flaw in workqueue processing where the function check_flush_dependency() can dereference a NULL pointer when invoked by a kworker that is not currently executing a work item. This occurs during out‑of‑memory handling or worker allocation paths, causing the kernel to crash and the system to reboot. The issue is a classic NULL pointer dereference (CWE‑476).

Affected Systems

The vulnerability is present in all Linux kernel builds that lack the subsequent patch, including all current LTS and mainline releases up until the fix is merged. No specific version ranges are given, so any kernel that has not incorporated the commit should be considered affected.

Risk and Exploitability

The CVSS score is not published and the EPSS is not available; however, the weakness can lead to a hard kernel panic when a low‑memory condition triggers worker allocation. Because the exploit requires local kernel code execution, an attacker with root privileges or the ability to trigger excessive allocation can produce a denial‑of‑service. The flaw is not listed in the CISA KEV catalog, but any system that experiences the crash should be considered at risk until the kernel is updated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< 8ffececcb88262389b4f91fed0fe4884b68204bc
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< 9bb739a5c5a570c28a62afb98e9326e2a49743c1
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< 513121e69388604619ea8c0ee07e86a3d1b5b5dc
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< 0c6b9b1e295aeff1132ac7aa738148cc65f06485
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< 1dccf5dc2f8fe688270b261ca4216e03c6a1e674
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< f97e6d0572d1b39998e053732332bc3cfdd0b9aa
`fca839c00a12d682cb59b3b620d109a1d850b262`	affected	< db6365ced4d5855e321f772b240c0e473bcfcdd5

Linux

affected

Version	Status	Constraints
`4.5`	affected	—
`0`	unaffected	< 4.5
`5.10.271`	unaffected	≤ 5.10.*
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.55`	unaffected	≤ 6.18.*
`7.2.9`	unaffected	≤ 7.2.*
`7.3-rc5`	unaffected	≤ *

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to the latest release that contains the commit fixing the NULL dereference in check_flush_dependency(), such as the newer mainline or LTS patch set.
Verify the running kernel includes the advisory commit hash (e.g., 0c6b9b1e) or the logic that guards worker->current_pwq against NULL.
If a kernel upgrade cannot be applied immediately, monitor dmesg and syslog for check_flush_dependency or OOM related messages and reboot the system to recover from any crash caused by this bug.

Generated by OpenCVE AI on October 18, 2026 at 17:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0c6b9b1e295aeff1132ac7aa738148cc65f06485
https://git.kernel.org/stable/c/1dccf5dc2f8fe688270b261ca4216e03c6a1e674
https://git.kernel.org/stable/c/513121e69388604619ea8c0ee07e86a3d1b5b5dc
https://git.kernel.org/stable/c/8ffececcb88262389b4f91fed0fe4884b68204bc
https://git.kernel.org/stable/c/9bb739a5c5a570c28a62afb98e9326e2a49743c1
https://git.kernel.org/stable/c/cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3
https://git.kernel.org/stable/c/db6365ced4d5855e321f772b240c0e473bcfcdd5
https://git.kernel.org/stable/c/f97e6d0572d1b39998e053732332bc3cfdd0b9aa

History

Sun, 18 Oct 2026 17:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Sun, 18 Oct 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in flush dependency check check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker and then dereferences worker->current_pwq to test whether the current workqueue is WQ_MEM_RECLAIM. current_wq_worker() only means that %current has PF_WQ_WORKER set. A kworker can reach check_flush_dependency() while it is not executing a work item. One such path is worker_thread() acting as the pool manager, where create_worker() does GFP_KERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->current_pwq is NULL because current_pwq is set only by process_one_work() and cleared again after the work function returns. [ 416.760634][ T375] Call trace: [ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P) [ 416.760648][ T375] __flush_work+0x98/0x224 [ 416.760657][ T375] flush_work+0x30/0x44 [ 416.760665][ T375] ... [ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0 [ 416.760719][ T375] out_of_memory+0xb4/0x458 [ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8 [ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c [ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4 [ 416.760753][ T375] new_slab+0x12c/0x484 [ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c [ 416.760765][ T375] __slab_alloc+0x74/0xd8 [ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304 [ 416.760779][ T375] alloc_worker+0x28/0x60 [ 416.760785][ T375] create_worker+0x4c/0x20c [ 416.760790][ T375] worker_thread+0xe8/0x2b8 [ 416.760796][ T375] kthread+0x1a8/0x200 [ 416.760805][ T375] ret_from_fork+0x10/0x20 Guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PF_MEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target is still reported.
Title		workqueue: Fix NULL current_pwq deref in flush dependency check
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0c6b9b1e295aeff1132ac7aa738148cc65f06485 https://git.kernel.org/stable/c/1dccf5dc2f8fe688270b261ca4216e03c6a1e674 https://git.kernel.org/stable/c/513121e69388604619ea8c0ee07e86a3d1b5b5dc https://git.kernel.org/stable/c/8ffececcb88262389b4f91fed0fe4884b68204bc https://git.kernel.org/stable/c/9bb739a5c5a570c28a62afb98e9326e2a49743c1 https://git.kernel.org/stable/c/cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3 https://git.kernel.org/stable/c/db6365ced4d5855e321f772b240c0e473bcfcdd5 https://git.kernel.org/stable/c/f97e6d0572d1b39998e053732332bc3cfdd0b9aa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-18T15:18:05.028Z

Updated: 2026-10-18T15:18:05.028Z

Reserved: 2026-09-25T10:25:14.355Z

Link: CVE-2026-98537

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-18T16:17:05.480

Modified: 2026-10-18T16:17:05.480

Link: CVE-2026-98537

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-18T17:30:16Z

Weaknesses

CWE-476
NULL Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object