---
id: CVE-2026-99103
title: 'workqueue: Fix unbound pool lifetime for pending pwqs'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  workqueue: Fix unbound pool lifetime for pending pwqs

  KASAN reports a use-after-free of an unbound worker_pool in
  node_activate_pending_pwq():

    BUG: KASAN: slab-use-…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5a70baec2294e8a7d0fcc4558741c23e752dad5c <
    6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
  - >-
    Linux >= 843288afd3cc6f3342659c6cf81fc47684d25563 <
    9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
  - >-
    Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 <
    390b9542fe670b8936738140ef9f349df6adeab6
  - >-
    Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 <
    f320b85c90fe5fc9d4d06badd450518323a94a7f
  - >-
    Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 <
    3d2ef2b9f4c084ab498494d26495a82f7e15407b
  - >-
    Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 <
    cf9c8aaea0d47410df8708bec195889f3a85cd3c
  - Linux fc67aebe34f22632ccb22faea48cc4d3134620a2
  - Linux >= 6.6.23 < 6.6.25
  - Linux >= 6.8.2 < 6.8.4
  - Linux >= 6.7.11 < 6.8
  - Linux 6.9
published: '2026-10-28'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T12:41:45.076Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99103'
references:
  - url: 'https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441'
  - url: 'https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849'
  - url: 'https://git.kernel.org/stable/c/390b9542fe670b8936738140ef9f349df6adeab6'
  - url: 'https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f'
  - url: 'https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b'
  - url: 'https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06789
ingestedAt: '2026-10-28T11:09:40.456Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker_pool in
node_activate_pending_pwq():

  BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120
  Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

  CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)
  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
  Workqueue:  0x0 (flush-8:0)
  Call Trace:
   <TASK>
   dump_stack_lvl+0x53/0x70
   print_report+0xce/0x610
   kasan_report+0xce/0x100
   _raw_spin_trylock+0x6d/0x120
   pwq_dec_nr_in_flight+0x4b4/0xcb0
   process_one_work+0x921/0x11a0
   worker_thread+0x4d0/0xd20
   kthread+0x2de/0x3c0
   ret_from_fork+0x3aa/0x620
   ret_from_fork_asm+0x1a/0x30
   </TASK>

  Allocated by task 311:
   alloc_pwq+0x439/0xca0
   apply_wqattrs_prepare+0x75e/0xd10
   apply_workqueue_attrs_locked+0x44/0xa0
   wq_nice_store+0x350/0x450

  Freed by task 0:
   kfree+0x127/0x3b0
   rcu_core+0x523/0x1780
   handle_softirqs+0x1b3/0x610

  Last potentially related work creation:
   put_unbound_pool+0x3f3/0x7d0
   pwq_release_workfn+0x494/0x8e0
   kthread_worker_fn+0x1ff/0x790

Canceling the last inactive work skips pwq_dec_nr_active(), so an empty
pwq can remain on pending_pwqs when its refcnt reaches zero.
pwq_release_workfn() currently puts the pool before removing that pwq.
If this drops the last pool reference, the pool can be RCU-freed while
the pwq remains reachable, and node_activate_pending_pwq() may trylock
the freed pool->lock.

Remove the pwq from pending_pwqs before putting the pool.

## Affected

- `Linux >= 5a70baec2294e8a7d0fcc4558741c23e752dad5c < 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441`
- `Linux >= 843288afd3cc6f3342659c6cf81fc47684d25563 < 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849`
- `Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 < 390b9542fe670b8936738140ef9f349df6adeab6`
- `Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 < f320b85c90fe5fc9d4d06badd450518323a94a7f`
- `Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 < 3d2ef2b9f4c084ab498494d26495a82f7e15407b`
- `Linux >= 5797b1c18919cd9c289ded7954383e499f729ce0 < cf9c8aaea0d47410df8708bec195889f3a85cd3c`
- `Linux fc67aebe34f22632ccb22faea48cc4d3134620a2`
- `Linux >= 6.6.23 < 6.6.25`
- `Linux >= 6.8.2 < 6.8.4`
- `Linux >= 6.7.11 < 6.8`
- `Linux 6.9`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.