CVE-2026-99058

workqueue: Fix NULL current_pwq deref in chained work check

State: Published
Severity: Not scored
Published: Oct 23, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in chained work check

current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function.

is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning.

Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	8d03ecfe471802d6afe97da97722b6924533aa82 to before 73bec442f913855907b63225306dd162c18e5c71Affected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 6877de2c75f0dd342099a1357856e6c8d474abc3Affected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 54361e4924c2c52a501b74ef10217c32f45fccfaAffected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 3dc61af2998cfc7312d6e59bbdcd5eed074483f2Affected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 729d576df89c7e4341e58c452f8890620a610ac2Affected 8d03ecfe471802d6afe97da97722b6924533aa82 to before b12a25fb2b9d5dac80e419d695450cc17a51fdfdAffected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 1a2668682e998039a027796b236319b380078a6aAffected 8d03ecfe471802d6afe97da97722b6924533aa82 to before 980db94e3eeefdd8a1c46f86412c33a7f7806f51Affected
LinuxLinux	3.9Affected before 3.9Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.113 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.11 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

8d03ecfe471802d6afe97da97722b6924533aa82 to before 73bec442f913855907b63225306dd162c18e5c71Affected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 6877de2c75f0dd342099a1357856e6c8d474abc3Affected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 54361e4924c2c52a501b74ef10217c32f45fccfaAffected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 3dc61af2998cfc7312d6e59bbdcd5eed074483f2Affected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 729d576df89c7e4341e58c452f8890620a610ac2Affected
8d03ecfe471802d6afe97da97722b6924533aa82 to before b12a25fb2b9d5dac80e419d695450cc17a51fdfdAffected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 1a2668682e998039a027796b236319b380078a6aAffected
8d03ecfe471802d6afe97da97722b6924533aa82 to before 980db94e3eeefdd8a1c46f86412c33a7f7806f51Affected

LinuxLinux

3.9Affected
before 3.9Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.113 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.11 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.