{"identifier":"CVE-2026-99103","cve":{"id":"CVE-2026-99103","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix unbound pool lifetime for pending pwqs\n\nKASAN reports a use-after-free of an unbound worker_pool in\nnode_activate_pending_pwq():\n\n  BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120\n  Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318\n\n  CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\n  Workqueue:  0x0 (flush-8:0)\n  Call Trace:\n   <TASK>\n   dump_stack_lvl+0x53/0x70\n   print_report+0xce/0x610\n   kasan_report+0xce/0x100\n   _raw_spin_trylock+0x6d/0x120\n   pwq_dec_nr_in_flight+0x4b4/0xcb0\n   process_one_work+0x921/0x11a0\n   worker_thread+0x4d0/0xd20\n   kthread+0x2de/0x3c0\n   ret_from_fork+0x3aa/0x620\n   ret_from_fork_asm+0x1a/0x30\n   </TASK>\n\n  Allocated by task 311:\n   alloc_pwq+0x439/0xca0\n   apply_wqattrs_prepare+0x75e/0xd10\n   apply_workqueue_attrs_locked+0x44/0xa0\n   wq_nice_store+0x350/0x450\n\n  Freed by task 0:\n   kfree+0x127/0x3b0\n   rcu_core+0x523/0x1780\n   handle_softirqs+0x1b3/0x610\n\n  Last potentially related work creation:\n   put_unbound_pool+0x3f3/0x7d0\n   pwq_release_workfn+0x494/0x8e0\n   kthread_worker_fn+0x1ff/0x790\n\nCanceling the last inactive work skips pwq_dec_nr_active(), so an empty\npwq can remain on pending_pwqs when its refcnt reaches zero.\npwq_release_workfn() currently puts the pool before removing that pwq.\nIf this drops the last pool reference, the pool can be RCU-freed while\nthe pwq remains reachable, and node_activate_pending_pwq() may trylock\nthe freed pool->lock.\n\nRemove the pwq from pending_pwqs before putting the pool.","published":"2026-10-28T11:17:29.593000+00:00","modified":"2026-10-28T11:17:29.593000+00:00","status":"Received","score":null,"severity":"UNSCORED","vector":"","cvss_version":"","affected":[],"weaknesses":[],"references":[{"url":"https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"kev":null,"kev_checked":true,"metrics":{},"configurations":[],"source":"nvd","retrieved_at":"2026-10-28T13:51:05.447915+00:00","exploited":false,"kev_stale":false,"products":[],"priority":{"label":"Assess exposure and vendor guidance","reasons":["No higher-priority signal is available in the current stored evidence.","Fresh EPSS data is unavailable; missing values are not zero."]},"epss":null,"version_assessment":null},"news":[],"campaigns":[],"domains":[{"domain":"git.kernel.org","source_url":"https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b","investigate_url":"https://investigate.aeglixmind.com/#git.kernel.org"}],"arsenal_url":"https://arsenal.aeglixmind.com/?cve=CVE-2026-99103","catalog_url":"https://cves.aeglixmind.com/cve/CVE-2026-99103","research_url":"https://investigate.aeglixmind.com/research/cve/CVE-2026-99103","coverage":{"news_candidates_checked":0,"campaign_candidates_checked":0,"bounded":false,"notice":"Exact CVE mentions in stored public excerpts and reviewed campaign content only. A mention is not proof of exploitation, attribution or tool suitability. Missing matches do not establish absence."}}