CVE-2026-98537

In the Linux kernel, the following vulnerability has been resolved:

workqueue: Fix NULL current pwq deref in flush dependency check

check flush dependency() uses current wq worker() to determine whether the caller is a workqueue worker and then dereferences worker->current pwq to test whether the current workqueue is WQ MEM RECLAIM.

current wq worker() only means that %current has PF WQ WORKER set. A kworker can reach check flush dependency() while it is not executing a work item. One such path is worker thread() acting as the pool manager, where create worker() does GFP KERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->current pwq is NULL because current pwq is set only by process one work() and cleared again after the work function returns.

[ 416.760634][ T375] Call trace: [ 416.760638][ T375] check flush dependency+0x80/0x120 (P) [ 416.760648][ T375] flush work+0x98/0x224 [ 416.760657][ T375] flush work+0x30/0x44 [ 416.760665][ T375] ... [ 416.760710][ T375] blocking notifier call chain+0x58/0xa0 [ 416.760719][ T375] out of memory+0xb4/0x458 [ 416.760730][ T375] alloc pages may oom+0x11c/0x1a8 [ 416.760739][ T375] alloc pages slowpath+0x314/0x46c [ 416.760746][ T375] alloc frozen pages noprof+0x110/0x1a4 [ 416.760753][ T375] new slab+0x12c/0x484 [ 416.760759][ T375] slab alloc+0x7a8/0xc7c [ 416.760765][ T375] slab alloc+0x74/0xd8 [ 416.760772][ T375] kmalloc cache node noprof+0x2ac/0x304 [ 416.760779][ T375] alloc worker+0x28/0x60 [ 416.760785][ T375] create worker+0x4c/0x20c [ 416.760790][ T375] worker thread+0xe8/0x2b8 [ 416.760796][ T375] kthread+0x1a8/0x200 [ 416.760805][ T375] ret from fork+0x10/0x20

Guard the WQ MEM RECLAIM-worker warning with worker->current pwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PF MEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQ MEM RECLAIM target is still reported.