Cloudanix VulnDB

CVE-2026-99058

None

CVSS

—

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can make the computer crash when certain background task operations are happening.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Memory Corruption
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NULL pointer dereference in is_chained_work() when a kworker reaches the chained-work test path outside of process_one_work() execution, causing worker->current_pwq to be NULL on a draining or destroying workqueue.

Why it matters to the business

Kernel panic or system crash that can be triggered during workqueue drain or destroy operations, leading to denial of service and unplanned downtime on affected Linux systems.

How an attack unfolds

An attacker with local access triggers workqueue drain or destroy paths while a kworker is active but not inside work-item execution; the missing current_pwq guard allows the NULL dereference to occur before the intended warning is emitted.

How to fix it

Update to a Linux kernel containing the fix that guards the chained-work test with worker->current_pwq; apply the patch or newer mainline/stable release that resolves the NULL dereference.

How to confirm the fix worked

Confirm the presence of the guard on worker->current_pwq in is_chained_work(); verify the system no longer panics under workqueue drain/destroy test cases that previously triggered the bug.

Typical attack path

  1. Obtain local code execution on the target system
  2. Trigger or wait for workqueue drain/destroy operations
  3. Arrange for a kworker to reach is_chained_work() without an active current_pwq
  4. Cause the NULL dereference and resulting kernel fault

How to detect it

Search kernel logs for oops/panic entries referencing workqueue, is_chained_work, or current_pwq; inspect crash dumps for NULL dereference during drain or destroy paths.

What your security team should do

  • Prioritize kernel updates on all Linux systems that perform frequent workqueue drain or destroy operations
  • Monitor for kernel oops or panic logs containing workqueue and current_pwq references
  • Test patched kernels in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function. is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning. Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.

Affected packages

Ecosystem Package Introduced Fixed