CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99058?
CVE-2026-99058 is a vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix NULL current_pwq deref in chained work check
current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function.
is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning.
Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.
Which versions are affected by CVE-2026-99058?
How do I fix CVE-2026-99058?
Upgrade to a fixed version.
Is CVE-2026-99058 being exploited?
There is no known exploitation of CVE-2026-99058 in the wild and no public exploit code.
Sources
Also known as AZL-110945, BELL-CVE-2026-99058, DEBIAN-CVE-2026-99058, GHSA-vhm2-x82m-jxjm, UBUNTU-CVE-2026-99058.