CVE-2026-98537

What it actually does

NULL pointer dereference of worker->current_pwq inside check_flush_dependency() when a kworker reaches the function outside of process_one_work(), such as when worker_thread() acts as pool manager during GFP_KERNEL allocation that triggers the OOM notifier.

Why it matters to the business

System instability or kernel panic on Linux hosts under memory pressure; low likelihood of widespread exploitation given stable low EPSS and lack of known threat actor use or ransomware campaigns.

How an attack unfolds

An attacker with local access exhausts memory to force OOM notifier invocation while a kworker is in the pool-manager path; this triggers the unguarded dereference of a NULL current_pwq, resulting in a crash rather than a controlled exploit.

How to fix it

Update to a Linux kernel containing the guard on worker->current_pwq before the WQ_MEM_RECLAIM warning; apply the fix from the workqueue patch that resolves the NULL dereference.

How to confirm the fix worked

Confirm kernel version contains the described guard; reproduce OOM conditions while monitoring for absence of the check_flush_dependency+0x80 call trace; review dmesg for the original panic signature.

Typical attack path

1. Obtain local code execution on a Linux system
2. Trigger sustained memory pressure to reach OOM paths
3. Cause kworker to enter worker_thread() pool-manager state
4. Invoke allocation that reaches out_of_memory() and blocking_notifier_call_chain()
5. Reach check_flush_dependency() with current_pwq still NULL

How to detect it

Search kernel logs and crash dumps for the exact call trace involving check_flush_dependency during OOM paths; correlate with alloc_worker and create_worker entries under memory pressure.

• check_flush_dependency+0x80/0x120
• worker_thread+0xe8/0x2b8
• create_worker+0x4c/0x20c
• out_of_memory+0xb4/0x458
• blocking_notifier_call_chain+0x58/0xa0

What your security team should do

• Prioritize kernel updates on systems that frequently hit memory pressure
• Monitor EPSS and KEV status for any future increase in exploit maturity
• Harden workloads to reduce OOM notifier frequency where feasible