This vulnerability arises from a NULL pointer dereference in the Linux kernel’s workqueue subsystem. When the kernel helper checks if a work item is chained, it accesses the current worker’s current_pwq field without verifying that the worker is executing a work function. If a kworker is outside of work-item execution, current_pwq is NULL, leading to a fault that causes a kernel panic and brings the operating system down. The flaw is specifically a null pointer dereference (CWE-476).

All Linux kernel releases prior to the inclusion of the commit that addresses CVE‑2026‑99058 are impacted. The defect resides in the generic workqueue implementation, so any distribution shipping an affected kernel version is at risk, regardless of the userspace environment.

The CVSS score of 4.7 indicates moderate severity, but the resulting kernel panic constitutes a full‑blown denial of service. The EPSS score is below 1 %, showing a low probability of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation would require privilege to schedule work on a draining or destroying workqueue, typically meaning local or privileged user access or the ability to coerce kernel scheduling. The likely attack vector is local code execution or privilege escalation within the kernel.