{"id":"CVE-2026-99058","kind":"vulnerability","aliases":["CVE-2026-99058"],"related":[],"title":"Linux kernel: workqueue NULL dereference when queueing on draining workqueue","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL current_pwq deref in chained work check\n\ncurrent_wq_worker() only tells us that %current is a kworker. It does\nnot guarantee that the worker is currently executing a work item, as\nworker->current_pwq is populated only while process_one_work() is running\nthe work function.\n\nis_chained_work() can be reached while queueing on a draining or\ndestroying workqueue. If a kworker outside work-item execution reaches\nthat path, current_wq_worker() returns a worker but worker->current_pwq is\nNULL, and the chained-work test can fault before it emits the intended\nwarning.\n\nGuard the chained-work test with worker->current_pwq. A kworker without\ncurrent_pwq is not executing work on the target workqueue, so the helper\nshould return false and let the draining/destroying warning fire.","summary":"A NULL pointer dereference in the Linux kernel workqueue code can fault when work is queued to a draining or destroying workqueue from a kworker that is not running a work item. The sources describe a kernel crash (denial of service) and do not describe code execution.","severity":"unknown","cvss":null,"epss":0.00225,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","runtime","self-hosted"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:53:56+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T04:53:56Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: workqueue NULL dereference when queueing on draining workqueue","impact":"low","summary":"A NULL pointer dereference in the Linux kernel workqueue code can fault when work is queued to a draining or destroying workqueue from a kworker that is not running a work item. The sources describe a kernel crash (denial of service) and do not describe code execution.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"Kernel fault crashes the machine; no code execution described.","analyst_note":"Check the NVD entry and the kernel stable commit for affected version ranges, fixed versions and CVSS; confirm whether an unprivileged local path reaches this.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000534,"input_tokens":3497,"output_tokens":368,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-99058':13A,16A 'chain':88C,132C,171C,185C 'chained-work':170C,184C 'check':90C 'code':33B,69B 'crash':61B 'current':84C,91C,98C,110C,117C,156C,164C,190C,195C 'cve':11A,14A 'denial':62B 'deref':86C 'derefer':5A,27B 'describ':58B,68B 'destroy':44B,143C 'drain':9A,42B,141C 'draining/destroying':214C 'emit':178C 'execut':70B,111C,152C,199C 'fals':210C 'fault':35B,175C 'fire':216C 'fix':82C 'follow':76C 'function':130C 'guarante':105C 'guard':182C 'helper':207C 'host':23B 'intend':180C 'item':55B,114C,151C 'kernel':2A,19B,31B,60B,74C 'kworker':48B,101C,147C,193C 'let':212C 'linux':1A,18B,30B,73C 'linux-kernel':17B 'null':4A,25B,83C,167C 'one':124C 'outsid':148C 'path':155C 'pointer':26B 'popul':120C 'process':123C 'pwq':85C,118C,165C,191C,196C 'queu':39B 'queue':7A,138C 'reach':136C,153C 'resolv':80C 'return':159C,209C 'run':52B,127C 'runtim':20B 'self':22B 'self-host':21B 'servic':64B 'sourc':57B 'target':203C 'tell':95C 'test':173C,187C 'us':96C 'vulner':77C 'warn':181C,215C 'without':194C 'work':37B,54B,89C,113C,125C,129C,133C,150C,172C,186C,200C 'work-item':149C 'worker':93C,108C,116C,158C,161C,163C,189C 'workqueu':3A,10A,32B,45B,81C,144C,204C 'wq':92C,157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99058","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99058","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-99058","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-99058","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}