This vulnerability arises from the Linux kernel’s workqueue subsystem. The function that checks whether a work item is chained can dereference a NULL pointer when the worker is outside of work‑item execution, such as during queue draining or destruction. If the check faults it forces a kernel panic, causing an operating system crash. The flaw qualifies as a NULL pointer dereference, leading to loss of availability and potential data corruption if an attacker can induce a crash.

All Linux kernel releases prior to the inclusion of the fix commit for CVE-2026-99058 are affected. The vulnerability impacts the generic kernel workqueue implementation, so any distribution that ships an affected kernel version is at risk.

The CVSS score is not supplied, but a kernel panic is effectively a complete denial of service. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require code execution with sufficient privileges to queue work into a draining or destroying workqueue, most likely achievable by a local user or an attacker who can influence kernel scheduling. Based on the description, the likely attack vector is local privileged execution or escalation of privilege within the kernel.