---
id: "CVE-2026-99058"
kind: "vulnerability"
aliases: ["CVE-2026-99058"]
title: "Linux kernel: workqueue NULL dereference when queueing on draining workqueue"
severity: "unknown"
cvss: null
epss: 0.00225
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["linux-kernel", "runtime", "self-hosted"]
not_affected_if: []
published_at: "2026-10-23T13:17:29+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99058", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-99058", "first_seen_at": "2026-10-25T12:38:50+00:00"}]
---

# Linux kernel: workqueue NULL dereference when queueing on draining workqueue

A NULL pointer dereference in the Linux kernel workqueue code can fault when work is queued to a draining or destroying workqueue from a kworker that is not running a work item. The sources describe a kernel crash (denial of service) and do not describe code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99058
- 2026-10-25T12:38:50+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-99058

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in chained work check

current_wq_worker() only tells us that %current is a kworker. It does
not guarantee that the worker is currently executing a work item, as
worker->current_pwq is populated only while process_one_work() is running
the work function.

is_chained_work() can be reached while queueing on a draining or
destroying workqueue. If a kworker outside work-item execution reaches
that path, current_wq_worker() returns a worker but worker->current_pwq is
NULL, and the chained-work test can fault before it emits the intended
warning.

Guard the chained-work test with worker->current_pwq. A kworker without
current_pwq is not executing work on the target workqueue, so the helper
should return false and let the draining/destroying warning fire.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_