CVE-2026-99103: workqueue: Fix unbound pool lifetime for pending pwqs
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix unbound pool lifetime for pending pwqs
KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq():
BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318
CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dumpstacklvl+0x53/0x70 printreport+0xce/0x610 kasanreport+0xce/0x100 rawspintrylock+0x6d/0x120 pwqdecnrinflight+0x4b4/0xcb0 processonework+0x921/0x11a0 workerthread+0x4d0/0xd20 kthread+0x2de/0x3c0 retfromfork+0x3aa/0x620 retfromforkasm+0x1a/0x30 </TASK>
Allocated by task 311: allocpwq+0x439/0xca0 applywqattrsprepare+0x75e/0xd10 applyworkqueueattrslocked+0x44/0xa0 wqnicestore+0x350/0x450
Freed by task 0: kfree+0x127/0x3b0 rcucore+0x523/0x1780 handlesoftirqs+0x1b3/0x610
Last potentially related work creation: putunboundpool+0x3f3/0x7d0 pwqreleaseworkfn+0x494/0x8e0 kthreadworkerfn+0x1ff/0x790
Canceling the last inactive work skips pwqdecnractive(), so an empty pwq can remain on pendingpwqs when its refcnt reaches zero. pwqreleaseworkfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and nodeactivatependingpwq() may trylock the freed pool->lock.
Remove the pwq from pendingpwqs before putting the pool.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.25 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.8.4 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.115 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.13 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 7.2.14-1 - Compensating control
In workqueue pwq_release_workfn(), remove the pwq from pending_pwqs before putting the pool, preventing the pool from being RCU-freed while the pwq remains reachable.