CVE-2026-98537

workqueue: Fix NULL current_pwq deref in flush dependency check

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in flush dependency check

check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker and then dereferences worker->current_pwq to test whether the current workqueue is WQ_MEM_RECLAIM.

current_wq_worker() only means that %current has PF_WQ_WORKER set. A kworker can reach check_flush_dependency() while it is not executing a work item. One such path is worker_thread() acting as the pool manager, where create_worker() does GFP_KERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->current_pwq is NULL because current_pwq is set only by process_one_work() and cleared again after the work function returns.

[ 416.760634][ T375] Call trace: [ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P) [ 416.760648][ T375] __flush_work+0x98/0x224 [ 416.760657][ T375] flush_work+0x30/0x44 [ 416.760665][ T375] ... [ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0 [ 416.760719][ T375] out_of_memory+0xb4/0x458 [ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8 [ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c [ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4 [ 416.760753][ T375] new_slab+0x12c/0x484 [ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c [ 416.760765][ T375] __slab_alloc+0x74/0xd8 [ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304 [ 416.760779][ T375] alloc_worker+0x28/0x60 [ 416.760785][ T375] create_worker+0x4c/0x20c [ 416.760790][ T375] worker_thread+0xe8/0x2b8 [ 416.760796][ T375] kthread+0x1a8/0x200 [ 416.760805][ T375] ret_from_fork+0x10/0x20

Guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PF_MEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target is still reported.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fca839c00a12d682cb59b3b620d109a1d850b262 to before 8ffececcb88262389b4f91fed0fe4884b68204bcAffected fca839c00a12d682cb59b3b620d109a1d850b262 to before 9bb739a5c5a570c28a62afb98e9326e2a49743c1Affected fca839c00a12d682cb59b3b620d109a1d850b262 to before cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3Affected fca839c00a12d682cb59b3b620d109a1d850b262 to before 513121e69388604619ea8c0ee07e86a3d1b5b5dcAffected fca839c00a12d682cb59b3b620d109a1d850b262 to before 0c6b9b1e295aeff1132ac7aa738148cc65f06485Affected fca839c00a12d682cb59b3b620d109a1d850b262 to before 1dccf5dc2f8fe688270b261ca4216e03c6a1e674Affected fca839c00a12d682cb59b3b620d109a1d850b262 to before f97e6d0572d1b39998e053732332bc3cfdd0b9aaAffected fca839c00a12d682cb59b3b620d109a1d850b262 to before db6365ced4d5855e321f772b240c0e473bcfcdd5Affected
LinuxLinux	4.5Affected before 4.5Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

fca839c00a12d682cb59b3b620d109a1d850b262 to before 8ffececcb88262389b4f91fed0fe4884b68204bcAffected
fca839c00a12d682cb59b3b620d109a1d850b262 to before 9bb739a5c5a570c28a62afb98e9326e2a49743c1Affected
fca839c00a12d682cb59b3b620d109a1d850b262 to before cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3Affected
fca839c00a12d682cb59b3b620d109a1d850b262 to before 513121e69388604619ea8c0ee07e86a3d1b5b5dcAffected
fca839c00a12d682cb59b3b620d109a1d850b262 to before 0c6b9b1e295aeff1132ac7aa738148cc65f06485Affected
fca839c00a12d682cb59b3b620d109a1d850b262 to before 1dccf5dc2f8fe688270b261ca4216e03c6a1e674Affected
fca839c00a12d682cb59b3b620d109a1d850b262 to before f97e6d0572d1b39998e053732332bc3cfdd0b9aaAffected
fca839c00a12d682cb59b3b620d109a1d850b262 to before db6365ced4d5855e321f772b240c0e473bcfcdd5Affected

LinuxLinux

4.5Affected
before 4.5Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.