Read the docs
TI-2026-81810 Aliases CVE-2026-99103GHSA-qwjv-757x-9f99

Use-after-free of unbound worker pool in Linux kernel workqueue

Priority LOW 22Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Partial Red Hat: 5 without a fix

No CVSS vector from any source. Fix status from CNA and Red Hat.

Summary

The Linux kernel workqueue frees an unbound worker pool while an empty pending pool work queue still references it, causing a use-after-free read. The flaw affects Linux kernel from 6.6.23 before 6.6.25, from 6.8.2 before 6.8.4, from 6.7.11 before 6.8, and from 6.9.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq(): BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318 CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK> Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450 Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610 Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790 Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock. Remove the pwq from pending_pwqs before putting the pool.

Why it matters now

EPSS 0.00173 6th percentileScored 2026-11-07
Fix Partial Linux (Linux): 6.6.25, 6.8.4, 6.8 +4Red Hat: 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
LinuxLinux6.6.23 to before 6.6.25; 6.8.2 to before 6.8.4; 6.7.11 to before 6.86.6.25, 6.8.4, 6.8Patch availableCNA
LinuxLinux6.9 and later6.6.25, 6.8.4, 6.12.115, 6.18.59, 7.2.13, 7.3Patch availableCNA
  • Linux VendorLinux Affected 6.6.23 to before 6.6.25; 6.8.2 to before 6.8.4; 6.7.11 to before 6.8 Fixed in 6.6.25, 6.8.4, 6.8 Patch available CNA
  • Linux VendorLinux Affected 6.9 and later Fixed in 6.6.25, 6.8.4, 6.12.115, 6.18.59, 7.2.13, 7.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*——Linux
  • cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* Versions — — ·Linux

Remediation

The Linux kernel is fixed in 6.6.25, 6.8.4, 6.8, 6.12.115, 6.18.59, 7.2.13 and 7.3. Red Hat lists Red Hat Enterprise Linux 6 as affected with no fix planned, and Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat OpenShift Container Platform 4 and Red Hat OpenShift Container Platform 5 as affected with no fix available.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA Linux (Linux) Fixed in 6.6.25, 6.8.4, 6.8
  • Fix · CNA Linux (Linux) Fixed in 6.6.25, 6.8.4, 6.12.115, 6.18.59, 7.2.13, 7.3

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 10AffectedNo fix yet: Fix deferred
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred
Not affected: 4 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-99103
  2. 2026-10-28 Alias added: GHSA-qwjv-757x-9f99
  3. 2026-10-29 Affected versions changed · Red Hat
  4. 2026-10-29 CVSS score added · Red Hat
  5. 2026-10-30 Fix available: Linux/Linux@390b9542fe670b8936738140ef9f349df6adeab6, Linux/[email protected] · CNA
  6. 2026-10-30 1 new reference · CNA
  7. 2026-11-06 Affected versions changed · Red Hat

References

Other 6

  • TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
  • TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
  • TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
  • TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
  • TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
  • TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
See all 21741 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences