GIVE YOUR AGENT THE EVIDENCE

Set up in your agent.

One prompt to get started. Paste it into your coding agent to connect cve.new through MCP and bring vulnerability context into your workflow.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

GIVE YOUR AGENT THE EVIDENCE

Investigate in your agent.

Turn this advisory into a focused investigation. Ask your agent to check your project’s versions, explain the evidence, and suggest a compatible fix.

Your agent needs remote MCP support and access to https://cve.new/mcp.

Read the setup guide

cve.new
Check your stack
CVE-2026-99103unknown

workqueue: Fix unbound pool lifetime for pending pwqs

Impact

In the Linux kernel, the following vulnerability has been resolved:

Source excerpt · Linux

What to do

Remove the pwq from pending_pwqs before putting the pool.

Linux guidance

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Linux · Linux

Other versions: unaffected

Version / rangeSource status
5a70baec2294e8a7d0fcc4558741c23e752dad5c to before 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441affected
843288afd3cc6f3342659c6cf81fc47684d25563 to before 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849affected
5797b1c18919cd9c289ded7954383e499f729ce0 to before f320b85c90fe5fc9d4d06badd450518323a94a7faffected
5797b1c18919cd9c289ded7954383e499f729ce0 to before 3d2ef2b9f4c084ab498494d26495a82f7e15407baffected
5797b1c18919cd9c289ded7954383e499f729ce0 to before cf9c8aaea0d47410df8708bec195889f3a85cd3caffected
fc67aebe34f22632ccb22faea48cc4d3134620a2affected
6.6.23 to before 6.6.25affected
6.8.2 to before 6.8.4affected
6.7.11 to before 6.8affected
Linux version evidence

Linux · Linux

Other versions: affected

Version / rangeSource status
6.9affected
0 to before 6.9unaffected
6.6.25 through 6.6.* (inclusive)unaffected
6.8.4 through 6.8.* (inclusive)unaffected
6.18.59 through 6.18.* (inclusive)unaffected
7.2.13 through 7.2.* (inclusive)unaffected
7.3 through * (inclusive)unaffected
Linux version evidence

Original source description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq():

BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dump_stack_lvl+0x53/0x70 print_report+0xce/0x610 kasan_report+0xce/0x100 _raw_spin_trylock+0x6d/0x120 pwq_dec_nr_in_flight+0x4b4/0xcb0 process_one_work+0x921/0x11a0 worker_thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret_from_fork+0x3aa/0x620 ret_from_fork_asm+0x1a/0x30 </TASK>

Allocated by task 311: alloc_pwq+0x439/0xca0 apply_wqattrs_prepare+0x75e/0xd10 apply_workqueue_attrs_locked+0x44/0xa0 wq_nice_store+0x350/0x450

Freed by task 0: kfree+0x127/0x3b0 rcu_core+0x523/0x1780 handle_softirqs+0x1b3/0x610

Last potentially related work creation: put_unbound_pool+0x3f3/0x7d0 pwq_release_workfn+0x494/0x8e0 kthread_worker_fn+0x1ff/0x790

Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool->lock.

Remove the pwq from pending_pwqs before putting the pool.

References