{"id":"CVE-2026-99103","kind":"vulnerability","aliases":["CVE-2026-99103"],"related":[],"title":"Linux kernel: workqueue use-after-free can crash or corrupt memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix unbound pool lifetime for pending pwqs\n\nKASAN reports a use-after-free of an unbound worker_pool in\nnode_activate_pending_pwq():\n\n  BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120\n  Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318\n\n  CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Workqueue:  0x0 (flush-8:0)\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x53/0x70\n   print_report+0xce/0x610\n   kasan_report+0xce/0x100\n   _raw_spin_trylock+0x6d/0x120\n   pwq_dec_nr_in_flight+0x4b4/0xcb0\n   process_one_work+0x921/0x11a0\n   worker_thread+0x4d0/0xd20\n   kthread+0x2de/0x3c0\n   ret_from_fork+0x3aa/0x620\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>\n\n  Allocated by task 311:\n   alloc_pwq+0x439/0xca0\n   apply_wqattrs_prepare+0x75e/0xd10\n   apply_workqueue_attrs_locked+0x44/0xa0\n   wq_nice_store+0x350/0x450\n\n  Freed by task 0:\n   kfree+0x127/0x3b0\n   rcu_core+0x523/0x1780\n   handle_softirqs+0x1b3/0x610\n\n  Last potentially related work creation:\n   put_unbound_pool+0x3f3/0x7d0\n   pwq_release_workfn+0x494/0x8e0\n   kthread_worker_fn+0x1ff/0x790\n\nCanceling the last inactive work skips pwq_dec_nr_active(), so an empty\npwq can remain on pending_pwqs when its refcnt reaches zero.\npwq_release_workfn() currently puts the pool before removing that pwq.\nIf this drops the last pool reference, the pool can be RCU-freed while\nthe pwq remains reachable, and node_activate_pending_pwq() may trylock\nthe freed pool->lock.\n\nRemove the pwq from pending_pwqs before putting the pool.","summary":"A workqueue bug in the Linux kernel lets an unbound worker pool be freed while a pending pool-queue still references it, causing a use-after-free when the freed lock is taken. The sources describe a KASAN-reported crash and the fix ordering, but do not state an attacker-controlled impact.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","other","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release in the kernel stable tree\n- Confirm the commit 'workqueue: Fix unbound pool lifetime for pending pwqs' is present in the kernel source or distro changelog","fix":"- Update to a kernel release that includes the upstream commit 'workqueue: Fix unbound pool lifetime for pending pwqs' (fixed version: unknown)","status":"open","published_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","triaged_at":"2026-10-28T11:37:52+00:00","updated_at":"2026-10-28T11:37:52+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-28T11:37:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a kernel release that includes the upstream commit 'workqueue: Fix unbound pool lifetime for pending pwqs' (fixed version: unknown)","reach":"local","title":"Linux kernel: workqueue use-after-free can crash or corrupt memory","impact":"medium","summary":"A workqueue bug in the Linux kernel lets an unbound worker pool be freed while a pending pool-queue still references it, causing a use-after-free when the freed lock is taken. The sources describe a KASAN-reported crash and the fix ordering, but do not state an attacker-controlled impact.","category":"other","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown; use-after-free in kernel memory, possible crash or corruption","analyst_note":"Check the NVD entry and the kernel stable commit for the fixed kernel versions and whether an unprivileged user can trigger it.","how_to_check":"- Check the running kernel version with `uname -r` and compare it with the fixed release in the kernel stable tree\n- Confirm the commit 'workqueue: Fix unbound pool lifetime for pending pwqs' is present in the kernel source or distro changelog","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Linux systems running a kernel without this fix, with unbound workqueues in use; the KASAN trace shows it triggered by changing workqueue attributes such as wq_nice. Systems on distro kernels should check their vendor's backport status. Sources do not say how an unprivileged user could reach it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000713,"input_tokens":4112,"output_tokens":604,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':127C,177C,181C,185C,190C,197C,202C,206C,209C,214C,220C,228C,233C,239C,244C,251C,255C,259C,269C,274C,279C '-1':165C '-2026':14A,17A '-8':170C '-99103':15A,18A '0':143C,148C,171C,249C '0/318':139C '04/01/2014':166C '0x0':168C '1':141C,152C '1.15.0':164C '1996':162C '311':225C '318':145C '4':132C '7.2.0':151C 'activ':113C,290C,337C 'addr':134C 'alloc':222C,226C 'appli':230C,235C 'asm':219C 'attack':78B 'attacker-control':77B 'attr':237C 'bio':163C 'bug':27B,116C 'call':172C 'cancel':281C 'caus':48B 'comm':146C 'control':79B 'core':254C 'corrupt':11A 'cpu':140C 'crash':9A,67B 'creation':265C 'current':308C 'cve':13A,16A 'dec':193C,288C 'describ':62B 'drop':318C 'dump':174C 'empti':293C 'ffff8880089ce000':135C 'fix':70B,92C 'flight':196C 'flush':169C 'fn':278C 'follow':86C 'fork':213C,218C 'free':7A,53B,105C,122C 'freed':38B,56B,246C,329C,343C 'handl':257C 'hardwar':155C 'host':24B 'i440fx':160C 'impact':80B 'inact':284C 'kasan':65B,99C,117C,183C 'kasan-report':64B 'kernel':2A,19B,31B,84C 'kfree':250C 'kthread':208C,276C 'kworker/u22':138C,147C 'last':261C,283C,320C 'lazi':154C 'let':32B 'lifetim':95C 'linux':1A,20B,30B,83C 'lock':57B,238C,345C 'lvl':176C 'may':340C 'memori':12A 'name':156C 'nice':242C 'node':112C,336C 'nr':194C,289C 'one':200C 'order':71B 'pc':159C 'pend':41B,97C,114C,298C,338C,350C 'pid':144C 'piix':161C 'pool':36B,43B,94C,110C,268C,311C,321C,324C,344C,355C 'pool-queu':42B 'potenti':262C 'preempt':153C 'prepar':232C 'print':179C 'process':199C 'put':266C,309C,353C 'pwq':115C,192C,227C,271C,287C,294C,305C,315C,332C,339C,348C 'pwqs':98C,299C,351C 'qemu':157C 'queue':44B 'raw':124C,187C 'rcu':253C,328C 'rcu-fre':327C 'reach':303C 'reachabl':334C 'read':129C 'refcnt':302C 'refer':46B,322C 'relat':263C 'releas':272C,306C 'remain':296C,333C 'remov':313C,346C 'report':66B,100C,180C,184C 'resolv':90C 'ret':211C,216C 'self':23B 'self-host':22B 'size':131C 'skip':286C 'slab':119C 'slab-use-after-fre':118C 'softirq':258C 'sourc':61B 'spin':125C,188C 'stack':175C 'standard':158C 'state':75B 'still':45B 'store':243C 'taint':150C 'taken':59B 'task':137C,224C,248C 'thread':205C 'trace':173C 'trylock':126C,189C,341C 'uid':142C 'unbound':34B,93C,108C,267C 'use':5A,51B,103C,120C 'use-after-fre':4A,50B,102C 'vulner':87C 'work':201C,264C,285C 'worker':35B,109C,204C,277C 'workfn':273C,307C 'workqueu':3A,26B,91C,167C,236C 'wq':241C 'wqattr':231C 'x127/0x3b0':252C 'x1a/0x30':221C 'x1b3/0x610':260C 'x1ff/0x790':280C 'x2de/0x3c0':210C 'x350/0x450':245C 'x3aa/0x620':215C 'x3f3/0x7d0':270C 'x439/0xca0':229C 'x44/0xa0':240C 'x494/0x8e0':275C 'x4b4/0xcb0':198C 'x4d0/0xd20':207C 'x523/0x1780':256C 'x53/0x70':178C 'x6d/0x120':128C,191C 'x75e/0xd10':234C 'x921/0x11a0':203C 'xce/0x100':186C 'xce/0x610':182C 'zero':304C","nicknames":[],"mitigations":[],"who_affected":"Linux systems running a kernel without this fix, with unbound workqueues in use; the KASAN trace shows it triggered by changing workqueue attributes such as wq_nice. Systems on distro kernels should check their vendor's backport status. Sources do not say how an unprivileged user could reach it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99103","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99103","severity":null,"published_at":"2026-10-28T11:17:29+00:00","modified_at":"2026-10-28T11:17:29+00:00","first_seen_at":"2026-10-28T11:32:34+00:00","fetched_at":"2026-10-28T11:32:34+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}