CVE-2026-98537: workqueue: Fix NULL current_pwq deref in flush dependency check
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix NULL currentpwq deref in flush dependency check
checkflushdependency() uses currentwqworker() to determine whether the caller is a workqueue worker and then dereferences worker->currentpwq to test whether the current workqueue is WQMEMRECLAIM.
currentwqworker() only means that %current has PFWQWORKER set. A kworker can reach checkflushdependency() while it is not executing a work item. One such path is workerthread() acting as the pool manager, where createworker() does GFPKERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->currentpwq is NULL because currentpwq is set only by processonework() and cleared again after the work function returns.
[ 416.760634][ T375] Call trace: [ 416.760638][ T375] checkflushdependency+0x80/0x120 (P) [ 416.760648][ T375] flushwork+0x98/0x224 [ 416.760657][ T375] flushwork+0x30/0x44 [ 416.760665][ T375] ... [ 416.760710][ T375] blockingnotifiercallchain+0x58/0xa0 [ 416.760719][ T375] outofmemory+0xb4/0x458 [ 416.760730][ T375] allocpagesmayoom+0x11c/0x1a8 [ 416.760739][ T375] allocpagesslowpath+0x314/0x46c [ 416.760746][ T375] allocfrozenpagesnoprof+0x110/0x1a4 [ 416.760753][ T375] newslab+0x12c/0x484 [ 416.760759][ T375] slaballoc+0x7a8/0xc7c [ 416.760765][ T375] slaballoc+0x74/0xd8 [ 416.760772][ T375] kmalloccachenodenoprof+0x2ac/0x304 [ 416.760779][ T375] allocworker+0x28/0x60 [ 416.760785][ T375] createworker+0x4c/0x20c [ 416.760790][ T375] workerthread+0xe8/0x2b8 [ 416.760796][ T375] kthread+0x1a8/0x200 [ 416.760805][ T375] retfromfork+0x10/0x20
Guard the WQMEMRECLAIM-worker warning with worker->currentpwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PFMEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQMEMRECLAIM target is still reported.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.159.1-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.159.1-1 - Upgrade
Upgrade
ubuntu/linux-aws-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1119.126~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1125.134~20.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1124.133~20.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1120.130~20.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-202.212~20.04.1 - Upgrade
Upgrade
ubuntu/linux-ibm-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.1 - Upgrade
Upgrade
ubuntu/linux-intel-iotg-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1114.120~20.04.1 - Upgrade
Upgrade
ubuntu/linux-lowlatency-hwe-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-197.207~20.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1070.72~20.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1116.122~20.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-5.15to a version that resolves this vulnerability.Fixed in 5.15.0-1113.117~20.04.2 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 5.15.0-202.212 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 5.15.0-1124.133 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 5.15.0-1115.121 - Upgrade
Upgrade
ubuntu/linux-gkeopto a version that resolves this vulnerability.Fixed in 5.15.0-1102.110 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 5.15.0-1113.117 - Upgrade
Upgrade
ubuntu/linux-intel-iotgto a version that resolves this vulnerability.Fixed in 5.15.0-1114.120 - Upgrade
Upgrade
ubuntu/linux-kvmto a version that resolves this vulnerability.Fixed in 5.15.0-1111.116 - Upgrade
Upgrade
ubuntu/linux-lowlatencyto a version that resolves this vulnerability.Fixed in 5.15.0-197.207 - Upgrade
Upgrade
ubuntu/linux-nvidiato a version that resolves this vulnerability.Fixed in 5.15.0-1114.115 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 5.15.0-1070.72 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegra-igxto a version that resolves this vulnerability.Fixed in 5.15.0-1059.59 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 5.15.0-1116.122 - Upgrade
Upgrade
ubuntu/linux-bluefieldto a version that resolves this vulnerability.Fixed in 5.15.0-1103.105 - Upgrade
Upgrade
ubuntu/linux-intel-iot-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1111.115 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 5.15.0-1118.127 - Upgrade
Upgrade
ubuntu/linux-aws-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1119.126+fips1 - Upgrade
Upgrade
ubuntu/linux-azure-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1125.134+fips1 - Upgrade
Upgrade
ubuntu/linux-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-202.212+fips1 - Upgrade
Upgrade
ubuntu/linux-gcp-fipsto a version that resolves this vulnerability.Fixed in 5.15.0-1120.130+fips1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the Linux kernel workqueue flush dependency check, guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq, checking the current workqueue only when worker->current_pwq is non-NULL.
Event History
Frequently Asked Questions
When can the NULL dereference occur?
It can occur when a kworker reaches the flush-dependency check while it is not executing a work item. The described path is a worker acting as a pool manager, creating another worker with GFP_KERNEL allocation, which invokes the OOM notifier.
Is a workqueue worker necessarily processing work when this happens?
No. PF_WQ_WORKER causes current_wq_worker() to identify the task as a workqueue worker even when worker->current_pwq is NULL. current_pwq is set only while process_one_work() is running and is cleared after the work function returns.
How can I recognize this issue in kernel logs?
A relevant crash trace includes check_flush_dependency(), followed by __flush_work() and flush_work(), with an OOM/allocation path such as blocking_notifier_call_chain(), out_of_memory(), and __alloc_pages_may_oom().