DEBIAN-CVE-2026-99103: Use After Free

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix unbound pool lifetime for pending pwqs KASAN reports a use-after-free of an unbound workerpool in nodeactivatependingpwq(): BUG: KASAN: slab-use-after-free in rawspintrylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318 CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: <TASK> dumpstacklvl+0x53/0x70 printreport+0xce/0x610 kasanreport+0xce/0x100 rawspintrylock+0x6d/0x120 pwqdecnrinflight+0x4b4/0xcb0 processonework+0x921/0x11a0 workerthread+0x4d0/0xd20 kthread+0x2de/0x3c0 retfromfork+0x3aa/0x620 retfromforkasm+0x1a/0x30 </TASK> Allocated by task 311: allocpwq+0x439/0xca0 applywqattrsprepare+0x75e/0xd10 applyworkqueueattrslocked+0x44/0xa0 wqnicestore+0x350/0x450 Freed by task 0: kfree+0x127/0x3b0 rcucore+0x523/0x1780 handlesoftirqs+0x1b3/0x610 Last potentially related work creation: putunboundpool+0x3f3/0x7d0 pwqreleaseworkfn+0x494/0x8e0 kthreadworkerfn+0x1ff/0x790 Canceling the last inactive work skips pwqdecnractive(), so an empty pwq can remain on pendingpwqs when its refcnt reaches zero. pwqreleaseworkfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and nodeactivatependingpwq() may trylock the freed pool->lock. Remove the pwq from pendingpwqs before putting the pool.