CVE-2026-99103 - Vulnerability Details

- workqueue: Fix unbound pool lifetime for pending pwqs

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker_pool in
node_activate_pending_pwq():

BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120
Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: 0x0 (flush-8:0)
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
print_report+0xce/0x610
kasan_report+0xce/0x100
_raw_spin_trylock+0x6d/0x120
pwq_dec_nr_in_flight+0x4b4/0xcb0
process_one_work+0x921/0x11a0
worker_thread+0x4d0/0xd20
kthread+0x2de/0x3c0
ret_from_fork+0x3aa/0x620
ret_from_fork_asm+0x1a/0x30
</TASK>

Allocated by task 311:
alloc_pwq+0x439/0xca0
apply_wqattrs_prepare+0x75e/0xd10
apply_workqueue_attrs_locked+0x44/0xa0
wq_nice_store+0x350/0x450

Freed by task 0:
kfree+0x127/0x3b0
rcu_core+0x523/0x1780
handle_softirqs+0x1b3/0x610

Last potentially related work creation:
put_unbound_pool+0x3f3/0x7d0
pwq_release_workfn+0x494/0x8e0
kthread_worker_fn+0x1ff/0x790

Canceling the last inactive work skips pwq_dec_nr_active(), so an empty
pwq can remain on pending_pwqs when its refcnt reaches zero.
pwq_release_workfn() currently puts the pool before removing that pwq.
If this drops the last pool reference, the pool can be RCU-freed while
the pwq remains reachable, and node_activate_pending_pwq() may trylock
the freed pool->lock.

Remove the pwq from pending_pwqs before putting the pool.

Published: 2026-10-28

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability is a use-after-free in the Linux kernel's workqueue subsystem. A pending worker queue (pwq) can outlive its associated worker pool when the pool’s reference count drops to zero. The node_activate_pending_pwq function may then trylock a freed pool lock, causing a KASAN-detected use-after-free and possible kernel crash or arbitrary code execution.

Affected Systems

Linux kernel for all distributions that have not yet applied the workqueue unbound pool lifetime fix, including any kernel version before the patch commit 3d2ef2b9f4c084ab498494d26495a82f7e15407b. No specific vendor versions are listed in the advisory.

Risk and Exploitability

The CVSS score is not provided and EPSS data is unavailable, but use-after-free in the kernel is considered high risk. The KEV catalog does not list this vulnerability. The likely attack vector is local, requiring interaction with the kernel's scheduling mechanisms; exploitation would be most effective from privileged or compromised processes. No public exploit is known at the time of this analysis.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`5a70baec2294e8a7d0fcc4558741c23e752dad5c`	affected	< 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
`843288afd3cc6f3342659c6cf81fc47684d25563`	affected	< 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
`5797b1c18919cd9c289ded7954383e499f729ce0`	affected	< f320b85c90fe5fc9d4d06badd450518323a94a7f
`5797b1c18919cd9c289ded7954383e499f729ce0`	affected	< 3d2ef2b9f4c084ab498494d26495a82f7e15407b
`5797b1c18919cd9c289ded7954383e499f729ce0`	affected	< cf9c8aaea0d47410df8708bec195889f3a85cd3c
`fc67aebe34f22632ccb22faea48cc4d3134620a2`	affected	—
`6.6.23`	affected	< 6.6.25
`6.8.2`	affected	< 6.8.4
`6.7.11`	affected	< 6.8

Linux

affected

Version	Status	Constraints
`6.9`	affected	—
`0`	unaffected	< 6.9
`6.6.25`	unaffected	≤ 6.6.*
`6.8.4`	unaffected	≤ 6.8.*
`6.18.59`	unaffected	≤ 6.18.*
`7.2.13`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

100%

Version	Status	Scheme	Platform
`[5a70baec2294e8a7d0fcc4558741c23e752dad5c,6741dd3fd38e47c08bc39d11ef5fa141fa6d0441)`	affected	code_commit	—
`[843288afd3cc6f3342659c6cf81fc47684d25563,9f5d5aef3072a33c6f9bfb954bb0cba1c2541849)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,f320b85c90fe5fc9d4d06badd450518323a94a7f)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,3d2ef2b9f4c084ab498494d26495a82f7e15407b)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,cf9c8aaea0d47410df8708bec195889f3a85cd3c)`	affected	code_commit	—
`fc67aebe34f22632ccb22faea48cc4d3134620a2`	affected	code_commit	—
`[6.6.23,6.6.25)`	affected	semver	—
`[6.8.2,6.8.4)`	affected	semver	—
`[6.7.11,6.8)`	affected	generic	—

Linux

100%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.6.25,7.0.0)`	unaffected	semver	—
`[6.8.4,7.0.0)`	unaffected	semver	—
`[6.18.59,6.19.0)`	unaffected	semver	—
`[7.2.13,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`[5a70baec2294e8a7d0fcc4558741c23e752dad5c,6741dd3fd38e47c08bc39d11ef5fa141fa6d0441)`	affected	code_commit	—
`[843288afd3cc6f3342659c6cf81fc47684d25563,9f5d5aef3072a33c6f9bfb954bb0cba1c2541849)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,f320b85c90fe5fc9d4d06badd450518323a94a7f)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,3d2ef2b9f4c084ab498494d26495a82f7e15407b)`	affected	code_commit	—
`[5797b1c18919cd9c289ded7954383e499f729ce0,cf9c8aaea0d47410df8708bec195889f3a85cd3c)`	affected	code_commit	—
`fc67aebe34f22632ccb22faea48cc4d3134620a2`	affected	code_commit	—
`[6.6.23,6.6.25)`	affected	semver	—
`[6.8.2,6.8.4)`	affected	semver	—
`[6.7.11,6.8)`	affected	generic	—

Linux

Linux Kernel

100%

Version	Status	Scheme	Platform
`6.9`	affected	generic	—
`[0,6.9)`	unaffected	generic	—
`[6.6.25,7.0.0)`	unaffected	semver	—
`[6.8.4,7.0.0)`	unaffected	semver	—
`[6.18.59,6.19.0)`	unaffected	semver	—
`[7.2.13,7.3.0)`	unaffected	semver	—
`[7.3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that contains the workqueue unbound pool lifetime repair (any patch after commit 3d2ef2b9f4c084ab498494d26495a82f7e15407b).
Check kernel messages for KASAN or panic logs that indicate unbound pool use-after-free and verify the patch is active.
If an upgrade cannot be performed immediately, limit the creation of pending work queues from untrusted processes by enforcing stricter access controls or SELinux/AppArmor policies to reduce the likelihood of the bug being triggered.

Generated by OpenCVE AI on October 28, 2026 at 12:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b
https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c
https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f

History

Wed, 28 Oct 2026 13:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 28 Oct 2026 12:00:00 +0000

Type	Values Removed	Values Added
First Time appeared		Linux linux
Vendors & Products		Linux linux

Wed, 28 Oct 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318 CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450 Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610 Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790 Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock. Remove the pwq from pending_pwqs before putting the pool.
Title		workqueue: Fix unbound pool lifetime for pending pwqs
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441 https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849 https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f

Subscriptions

Linux Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-28T10:34:22.945Z

Updated: 2026-10-28T10:34:22.945Z

Reserved: 2026-09-25T10:25:14.391Z

Link: CVE-2026-99103

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-28T11:17:29.593

Modified: 2026-10-28T11:17:29.593

Link: CVE-2026-99103

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-10-28T13:00:15Z

Weaknesses

CWE-416
Use After Free

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object