CVE-2026-99103

workqueue: Fix unbound pool lifetime for pending pwqs

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq():

BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK>

Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450

Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610

Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790

Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock.

Remove the pwq from pending_pwqs before putting the pool.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	5a70baec2294e8a7d0fcc4558741c23e752dad5c to before 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441Affected 843288afd3cc6f3342659c6cf81fc47684d25563 to before 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849Affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before 390b9542fe670b8936738140ef9f349df6adeab6Affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before f320b85c90fe5fc9d4d06badd450518323a94a7fAffected 5797b1c18919cd9c289ded7954383e499f729ce0 to before 3d2ef2b9f4c084ab498494d26495a82f7e15407bAffected 5797b1c18919cd9c289ded7954383e499f729ce0 to before cf9c8aaea0d47410df8708bec195889f3a85cd3cAffected fc67aebe34f22632ccb22faea48cc4d3134620a2Affected 6.6.23 to before 6.6.25Affected 6.8.2 to before 6.8.4Affected 6.7.11 to before 6.8Affected
LinuxLinux	6.9Affected before 6.9Not affected 6.6.25 through 6.6.Not affected 6.8.4 through 6.8.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

5a70baec2294e8a7d0fcc4558741c23e752dad5c to before 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441Affected
843288afd3cc6f3342659c6cf81fc47684d25563 to before 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849Affected
5797b1c18919cd9c289ded7954383e499f729ce0 to before 390b9542fe670b8936738140ef9f349df6adeab6Affected
5797b1c18919cd9c289ded7954383e499f729ce0 to before f320b85c90fe5fc9d4d06badd450518323a94a7fAffected
5797b1c18919cd9c289ded7954383e499f729ce0 to before 3d2ef2b9f4c084ab498494d26495a82f7e15407bAffected
5797b1c18919cd9c289ded7954383e499f729ce0 to before cf9c8aaea0d47410df8708bec195889f3a85cd3cAffected
fc67aebe34f22632ccb22faea48cc4d3134620a2Affected
6.6.23 to before 6.6.25Affected
6.8.2 to before 6.8.4Affected
6.7.11 to before 6.8Affected

LinuxLinux

6.9Affected
before 6.9Not affected
6.6.25 through 6.6.*Not affected
6.8.4 through 6.8.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.