Use-after-free in Linux kernel - CVE-2026-99103

Vulnerability details

The vulnerability allows a local user to potentially cause a denial of service by triggering access to freed kernel memory.

The vulnerability exists due to use-after-free in the Linux kernel workqueue subsystem when canceling the last inactive work leaves an empty pool_workqueue on pending_pwqs and its underlying unbound worker pool is freed before the pending entry is removed. A local user can potentially trigger pending workqueue activation to make node_activate_pending_pwq() access the freed pool's lock, causing a kernel crash and a denial of service.

Affected software

How to mitigate CVE-2026-99103

External References

• https://git.kernel.org/stable/c/3d2ef2b9f4c084ab498494d26495a82f7e15407b
• https://git.kernel.org/stable/c/6741dd3fd38e47c08bc39d11ef5fa141fa6d0441
• https://git.kernel.org/stable/c/9f5d5aef3072a33c6f9bfb954bb0cba1c2541849
• https://git.kernel.org/stable/c/cf9c8aaea0d47410df8708bec195889f3a85cd3c
• https://git.kernel.org/stable/c/f320b85c90fe5fc9d4d06badd450518323a94a7f

Related Security Bulletins

• Use-after-free in Linux kernel kernel/workqueue.c: pwq_release_workfn() and node_activate_pending_pwq()
• Debian update for linux