{"id":"CVE-2026-98537","kind":"vulnerability","aliases":["CVE-2026-98537"],"related":[],"title":"Linux kernel: workqueue NULL pointer dereference during flush dependency check","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in flush dependency check\n\ncheck_flush_dependency() uses current_wq_worker() to determine whether\nthe caller is a workqueue worker and then dereferences worker->current_pwq\nto test whether the current workqueue is WQ_MEM_RECLAIM.\n\ncurrent_wq_worker() only means that %current has PF_WQ_WORKER set. A\nkworker can reach check_flush_dependency() while it is not executing a\nwork item. One such path is worker_thread() acting as the pool manager,\nwhere create_worker() does GFP_KERNEL allocation and the allocation path\ninvokes the OOM notifier. In that state worker->current_pwq is NULL\nbecause current_pwq is set only by process_one_work() and cleared again\nafter the work function returns.\n\n[  416.760634][  T375] Call trace:\n[  416.760638][  T375]  check_flush_dependency+0x80/0x120 (P)\n[  416.760648][  T375]  __flush_work+0x98/0x224\n[  416.760657][  T375]  flush_work+0x30/0x44\n[  416.760665][  T375]  ...\n[  416.760710][  T375]  blocking_notifier_call_chain+0x58/0xa0\n[  416.760719][  T375]  out_of_memory+0xb4/0x458\n[  416.760730][  T375]  __alloc_pages_may_oom+0x11c/0x1a8\n[  416.760739][  T375]  __alloc_pages_slowpath+0x314/0x46c\n[  416.760746][  T375]  __alloc_frozen_pages_noprof+0x110/0x1a4\n[  416.760753][  T375]  new_slab+0x12c/0x484\n[  416.760759][  T375]  ___slab_alloc+0x7a8/0xc7c\n[  416.760765][  T375]  __slab_alloc+0x74/0xd8\n[  416.760772][  T375]  __kmalloc_cache_node_noprof+0x2ac/0x304\n[  416.760779][  T375]  alloc_worker+0x28/0x60\n[  416.760785][  T375]  create_worker+0x4c/0x20c\n[  416.760790][  T375]  worker_thread+0xe8/0x2b8\n[  416.760796][  T375]  kthread+0x1a8/0x200\n[  416.760805][  T375]  ret_from_fork+0x10/0x20\n\nGuard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the\nkworker is not currently executing a work item, there is no current\nworkqueue to diagnose with that warning. The PF_MEMALLOC warning is left\nunchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target\nis still reported.","summary":"A kernel worker thread that is not running a work item can crash the kernel when a flush dependency check dereferences a NULL pointer. The sources describe a kernel panic path reached through an out-of-memory notifier, not code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:05+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:44+00:00","updated_at":"2026-10-25T05:23:44+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:23:44Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: workqueue NULL pointer dereference during flush dependency check","impact":"low","summary":"A kernel worker thread that is not running a work item can crash the kernel when a flush dependency check dereferences a NULL pointer. The sources describe a kernel panic path reached through an out-of-memory notifier, not code execution.","category":"runtime","nicknames":[],"who_cares":["linux","kernel"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel NULL dereference crashes the machine, denial of service","analyst_note":"Check the kernel.org stable commit and the NVD entry for affected kernel version ranges and fixed releases.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000583,"input_tokens":4173,"output_tokens":331,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':202C,209C,215C,225C,232C,240C,247C,255C,261C,267C,273C,281C,287C,293C,299C,304C,311C '-2026':12A,15A '-98537':13A,16A '416.760634':193C '416.760638':197C '416.760648':205C '416.760657':211C '416.760665':217C '416.760710':219C '416.760719':227C '416.760730':234C '416.760739':242C '416.760746':249C '416.760753':257C '416.760759':263C '416.760765':269C '416.760772':275C '416.760779':283C '416.760785':289C '416.760790':295C '416.760796':301C '416.760805':306C 'act':147C 'alloc':158C,161C,236C,244C,251C,266C,272C,285C 'block':221C 'cach':278C 'call':195C,223C 'caller':93C 'chain':224C 'check':10A,39B,81C,82C,130C,199C 'clear':186C 'code':60B 'context':355C 'crash':32B 'creat':153C,291C 'current':75C,86C,102C,108C,114C,120C,171C,176C,323C,330C,338C 'cve':11A,14A 'depend':9A,38B,80C,84C,132C,201C 'deref':77C 'derefer':6A,40B,100C 'describ':46B 'determin':90C 'diagnos':341C 'execut':61B,137C,331C 'explicit':353C 'fix':73C 'flush':8A,37B,79C,83C,131C,200C,207C,213C,356C 'follow':67C 'fork':310C 'frozen':252C 'function':191C 'gfp':156C 'guard':313C 'invok':163C 'item':30B,140C,334C 'kernel':2A,17B,21B,34B,48B,65C,157C 'kmalloc':277C 'kthread':303C 'kworker':127C,327C 'left':350C 'linux':1A,18B,64C 'manag':151C 'may':238C 'mean':118C 'mem':112C,316C,359C 'memalloc':347C 'memori':57B,231C 'new':259C 'node':279C 'noprof':254C,280C 'notifi':58B,166C,222C 'null':4A,42B,74C,174C 'one':141C,183C 'oom':165C,239C 'out-of-memori':54B 'p':204C 'page':237C,245C,253C 'panic':49B 'path':50B,143C,162C 'pf':122C,346C 'pointer':5A,43B 'pool':150C 'process':182C 'pwq':76C,103C,172C,177C,324C 'reach':51B,129C 'reclaim':113C,318C,354C,360C 'reclaim-work':317C 'report':364C 'resolv':71C 'ret':308C 'return':192C 'run':27B 'runtim':19B 'set':125C,179C 'slab':260C,265C,271C 'slowpath':246C 'sourc':45B 'state':169C 'still':363C 't375':194C,198C,206C,212C,218C,220C,228C,235C,243C,250C,258C,264C,270C,276C,284C,290C,296C,302C,307C 'target':361C 'test':105C 'thread':23B,146C,298C 'trace':196C 'unchang':351C 'use':85C 'vulner':68C 'warn':320C,344C,348C 'whether':91C,106C 'work':29B,139C,184C,190C,208C,214C,333C 'worker':22B,88C,97C,101C,116C,124C,145C,154C,170C,286C,292C,297C,319C,322C 'workqueu':3A,72C,96C,109C,339C 'wq':87C,111C,115C,123C,315C,358C 'x10/0x20':312C 'x110/0x1a4':256C 'x11c/0x1a8':241C 'x12c/0x484':262C 'x1a8/0x200':305C 'x28/0x60':288C 'x2ac/0x304':282C 'x30/0x44':216C 'x314/0x46c':248C 'x4c/0x20c':294C 'x58/0xa0':226C 'x74/0xd8':274C 'x7a8/0xc7c':268C 'x80/0x120':203C 'x98/0x224':210C 'xb4/0x458':233C 'xe8/0x2b8':300C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:05+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98537","severity":null,"published_at":"2026-10-18T16:17:05+00:00","modified_at":"2026-10-19T10:19:09+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}