SB20261029213 - Use-after-free in Linux kernel kernel/workqueue.c: pwq_release_workfn() and node_activate_pending_pwq()

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-99103)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel workqueue subsystem when canceling the last inactive work leaves an empty pool_workqueue on pending_pwqs and its underlying unbound worker pool is freed before the pending entry is removed. A local user can potentially trigger pending workqueue activation to make node_activate_pending_pwq() access the freed pool's lock, causing a kernel crash and a denial of service.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b
• https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
• https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
• https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c
• https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f