workqueue: Fix NULL current_pwq deref in flush dependency check

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98537
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:05 UTC
Updated2026-10-18 16:17:05 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in flush dependency check check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker and then dereferences worker->current_pwq to test whether the current workqueue is WQ_MEM_RECLAIM. current_wq_worker() only means that %current has PF_WQ_WORKER set. A kworker can reach check_flush_dependency() while it is not executing a work item. One such path is worker_thread() acting as the pool manager, where create_worker() does GFP_KERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->current_pwq is NULL because current_pwq is set only by process_one_work() and cleared again after the work function returns. [ 416.760634][ T375] Call trace: [ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P) [ 416.760648][ T375] __flush_work+0x98/0x224 [ 416.760657][ T375] flush_work+0x30/0x44 [ 416.760665][ T375] ... [ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0 [ 416.760719][ T375] out_of_memory+0xb4/0x458 [ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8 [ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c [ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4 [ 416.760753][ T375] new_slab+0x12c/0x484 [ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c [ 416.760765][ T375] __slab_alloc+0x74/0xd8 [ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304 [ 416.760779][ T375] alloc_worker+0x28/0x60 [ 416.760785][ T375] create_worker+0x4c/0x20c [ 416.760790][ T375] worker_thread+0xe8/0x2b8 [ 416.760796][ T375] kthread+0x1a8/0x200 [ 416.760805][ T375] ret_from_fork+0x10/0x20 Guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PF_MEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target is still reported.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 8ffececcb88262389b4f91fed0fe4884b68204bc git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 9bb739a5c5a570c28a62afb98e9326e2a49743c1 git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3 git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 513121e69388604619ea8c0ee07e86a3d1b5b5dc git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 0c6b9b1e295aeff1132ac7aa738148cc65f06485 git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 1dccf5dc2f8fe688270b261ca4216e03c6a1e674 git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 f97e6d0572d1b39998e053732332bc3cfdd0b9aa git Not specified
CNA Linux Linux affected fca839c00a12d682cb59b3b620d109a1d850b262 db6365ced4d5855e321f772b240c0e473bcfcdd5 git Not specified
CNA Linux Linux affected 4.5 Not specified
CNA Linux Linux unaffected 4.5 semver Not specified
CNA Linux Linux unaffected 5.10.271 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.222 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.189 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.158 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.112 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.55 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.9 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/1dccf5dc2f8fe688270b261ca4216e03c6a1e674 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/513121e69388604619ea8c0ee07e86a3d1b5b5dc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/8ffececcb88262389b4f91fed0fe4884b68204bc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f97e6d0572d1b39998e053732332bc3cfdd0b9aa 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cc190a6a1d20b87e6a9435202fc2a3bd84c79fb3 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0c6b9b1e295aeff1132ac7aa738148cc65f06485 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/db6365ced4d5855e321f772b240c0e473bcfcdd5 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9bb739a5c5a570c28a62afb98e9326e2a49743c1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report