Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-99058— workqueue: Fix NULL current_pwq deref in chained work check

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： workqueue：修复 chained work 检查中对 current_pwq 的 NULL 解引用问题。 仅能表明当前进程（%current）是一个 kworker，但并不能保证该 worker 当前正在执行某个工作项。因为 只有在 运行工作函数期间才会被填充。 可能在向正在排空或销毁的工作队列（workqueue）入队时被调用。如果某个处于工作项执行之外的 kworker 进入该路径， 会返回一个 worker 结构，但此时 为 NULL，导致 chained

AI Predicted 5.5 Difficulty: Hard EPSS 0.18% · P8

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux 8d03ecfe471802d6afe97da97722b6924533aa82< 3dc61af2998cfc7312d6e59bbdcd5eed074483f2 affected
8d03ecfe471802d6afe97da97722b6924533aa82< 729d576df89c7e4341e58c452f8890620a610ac2 affected
8d03ecfe471802d6afe97da97722b6924533aa82< b12a25fb2b9d5dac80e419d695450cc17a51fdfd affected
8d03ecfe471802d6afe97da97722b6924533aa82< 1a2668682e998039a027796b236319b380078a6a affected
8d03ecfe471802d6afe97da97722b6924533aa82< 980db94e3eeefdd8a1c46f86412c33a7f7806f51 affected
3.9 affected
< 3.9 unaffected
6.6.160≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-99058

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
workqueue: Fix NULL current_pwq deref in chained work check
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in chained work check current_wq_worker() only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker->current_pwq is populated only while process_one_work() is running the work function. is_chained_work() can be reached while queueing on a draining or destroying workqueue. If a kworker outside work-item execution reaches that path, current_wq_worker() returns a worker but worker->current_pwq is NULL, and the chained-work test can fault before it emits the intended warning. Guard the chained-work test with worker->current_pwq. A kworker without current_pwq is not executing work on the target workqueue, so the helper should return false and let the draining/destroying warning fire.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 8d03ecfe471802d6afe97da97722b6924533aa82 ~ 3dc61af2998cfc7312d6e59bbdcd5eed074483f2 -
Linux Linux 3.9 -

II. Public POCs for CVE-2026-99058

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-99058

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-99058 (5)

Same Patch Batch · Linux · 2026-10-23 · 217 CVEs total

CVE-2026-98959 9.8 CRITICAL btrfs: fix xattr replace when multiple xattrs are packed in the same item
CVE-2026-99078 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry
CVE-2026-99079 9.8 CRITICAL net/mlx5e: Prevent stale XSK buffer release on refill retry
CVE-2026-98988 8.8 HIGH namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE
CVE-2026-99083 8.8 HIGH ksmbd: fix heap out-of-bounds write in krb5_authenticate()
CVE-2026-99082 8.8 HIGH KVM: x86: Use active memslots for the per-vCPU MMIO cache
CVE-2026-98981 8.8 HIGH namespace: unhash a dentry before detaching the mounts on it
CVE-2026-98980 8.8 HIGH namei: don't reveal overmounted entries in refwalk
CVE-2026-98870 8.8 HIGH ksmbd: remove stale channels from all sessions on teardown
CVE-2026-98978 8.4 HIGH namespace: never expire a locked mount
CVE-2026-99042 8.4 HIGH io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6
CVE-2026-98968 8.1 HIGH amt: send the relay's General Query directly from the receive path
CVE-2026-99064 8.1 HIGH cipso: adjust cached option offsets when removing CIPSO
CVE-2026-99014 7.8 HIGH Bluetooth: hci_sync: Fix command skb lifetime during scan setup
CVE-2026-98999 7.8 HIGH drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin
CVE-2026-99016 7.8 HIGH riscv: futex: untag the user pointer before the atomic access
CVE-2026-99018 7.8 HIGH riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp
CVE-2026-99051 7.8 HIGH fsverity: RCU-delay the freeing of struct fsverity_info
CVE-2026-99054 7.8 HIGH tipc: destroy topsrv workqueues before closing connections
CVE-2026-99053 7.8 HIGH tipc: hold a reference to nodes found by link name

Showing top 20 of 217 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux