CVE-2026-99103

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix unbound pool lifetime for pending pwqs

KASAN reports a use-after-free of an unbound worker pool in node activate pending pwq():

BUG: KASAN: slab-use-after-free in raw spin trylock+0x6d/0x120 Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318

CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: 0x0 (flush-8:0) Call Trace: dump stack lvl+0x53/0x70 print report+0xce/0x610 kasan report+0xce/0x100 raw spin trylock+0x6d/0x120 pwq dec nr in flight+0x4b4/0xcb0 process one work+0x921/0x11a0 worker thread+0x4d0/0xd20 kthread+0x2de/0x3c0 ret from fork+0x3aa/0x620 ret from fork asm+0x1a/0x30

Allocated by task 311: alloc pwq+0x439/0xca0 apply wqattrs prepare+0x75e/0xd10 apply workqueue attrs locked+0x44/0xa0 wq nice store+0x350/0x450

Freed by task 0: kfree+0x127/0x3b0 rcu core+0x523/0x1780 handle softirqs+0x1b3/0x610

Last potentially related work creation: put unbound pool+0x3f3/0x7d0 pwq release workfn+0x494/0x8e0 kthread worker fn+0x1ff/0x790

Canceling the last inactive work skips pwq dec nr active(), so an empty pwq can remain on pending pwqs when its refcnt reaches zero. pwq release workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node activate pending pwq() may trylock the freed pool->lock.

Remove the pwq from pending pwqs before putting the pool.