CVE-2026-98537

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current_pwq deref in flush dependency check

check_flush_dependency() uses current_wq_worker() to determine whether

the caller is a workqueue worker and then dereferences worker->current_pwq

to test whether the current workqueue is WQ_MEM_RECLAIM.

current_wq_worker() only means that %current has PF_WQ_WORKER set. A

kworker can reach check_flush_dependency() while it is not executing a

work item. One such path is worker_thread() acting as the pool manager,

where create_worker() does GFP_KERNEL allocation and the allocation path

invokes the OOM notifier. In that state worker->current_pwq is NULL

because current_pwq is set only by process_one_work() and cleared again

after the work function returns.

[ 416.760634][ T375] Call trace:

[ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P)

[ 416.760648][ T375] __flush_work+0x98/0x224

[ 416.760657][ T375] flush_work+0x30/0x44

[ 416.760665

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References