CVE-2026-98537 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
workqueue: Fix NULL current_pwq deref in flush dependency check
check_flush_dependency() uses current_wq_worker() to determine whether the caller is a workqueue worker and then dereferences worker->current_pwq to test whether the current workqueue is WQ_MEM_RECLAIM.
current_wq_worker() only means that %current has PF_WQ_WORKER set. A kworker can reach check_flush_dependency() while it is not executing a work item. One such path is worker_thread() acting as the pool manager, where create_worker() does GFP_KERNEL allocation and the allocation path invokes the OOM notifier. In that state worker->current_pwq is NULL because current_pwq is set only by process_one_work() and cleared again after the work function returns.
[ 416.760634][ T375] Call trace:
[ 416.760638][ T375] check_flush_dependency+0x80/0x120 (P)
[ 416.760648][ T375] __flush_work+0x98/0x224
[ 416.760657][ T375] flush_work+0x30/0x44
[ 416.760665][ T375] ...
[ 416.760710][ T375] blocking_notifier_call_chain+0x58/0xa0
[ 416.760719][ T375] out_of_memory+0xb4/0x458
[ 416.760730][ T375] __alloc_pages_may_oom+0x11c/0x1a8
[ 416.760739][ T375] __alloc_pages_slowpath+0x314/0x46c
[ 416.760746][ T375] __alloc_frozen_pages_noprof+0x110/0x1a4
[ 416.760753][ T375] new_slab+0x12c/0x484
[ 416.760759][ T375] ___slab_alloc+0x7a8/0xc7c
[ 416.760765][ T375] __slab_alloc+0x74/0xd8
[ 416.760772][ T375] __kmalloc_cache_node_noprof+0x2ac/0x304
[ 416.760779][ T375] alloc_worker+0x28/0x60
[ 416.760785][ T375] create_worker+0x4c/0x20c
[ 416.760790][ T375] worker_thread+0xe8/0x2b8
[ 416.760796][ T375] kthread+0x1a8/0x200
[ 416.760805][ T375] ret_from_fork+0x10/0x20
Guard the WQ_MEM_RECLAIM-worker warning with worker->current_pwq. If the kworker is not currently executing a work item, there is no current workqueue to diagnose with that warning. The PF_MEMALLOC warning is left unchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target is still reported.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a critical flaw within the workqueue subsystem related to how it handles memory allocation dependencies during worker thread initialization. Specifically, the function check_flush_dependency() attempts to determine if the calling process is executing as a workqueue worker by invoking current_wq_worker(). This helper only verifies that the PF_WQ_WORKER flag is set for the current task context. However, this flag remains active even when the kernel worker thread is not actively processing a specific work item. The vulnerability arises because check_flush_dependency() subsequently dereferences worker->current_pwq to verify if the current workqueue has the WQ_MEM_RECLAIM attribute set. This pointer field is only populated by process_one_work() while a task is executing and is cleared immediately after the work function returns. Consequently, when a kworker thread enters this code path without an active work item, worker->current_pwq holds a NULL value, leading to a null pointer dereference upon access.
The operational impact of this vulnerability manifests as a kernel panic or system crash triggered by memory pressure scenarios during dynamic resource allocation. The specific execution path involves the creation of new worker threads via create_worker(), which performs GFP_KERNEL allocations. If the system is under significant memory stress, these allocations may trigger the Out-Of-Memory (OOM) notifier chain through blocking_notifier_call_chain(). Within this notification context, flush_work() and subsequently check_flush_dependency() are invoked to manage workqueue flushing dependencies. Because the worker thread acting as a pool manager during creation does not have an associated current_pwq structure, the dereference operation fails immediately. This results in a denial of service condition where the affected system becomes unresponsive or reboots unexpectedly due to the fatal exception generated by accessing invalid memory addresses within kernel space.
From a technical classification perspective, this vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference flaw. The issue stems from insufficient validation of pointer validity before use, specifically failing to account for states where a thread is identified as a worker but lacks an active work context. In terms of the MITRE ATT&CK framework, while this is primarily a stability and reliability issue rather than a direct exploitation vector for privilege escalation or data exfiltration, it relates to techniques involving resource exhaustion or denial of service through kernel-level faults. Attackers could potentially leverage predictable memory pressure conditions to trigger this crash repeatedly, thereby disrupting system availability. The flaw highlights the complexity of maintaining state consistency in asynchronous execution models where thread identity and task context can diverge during critical subsystem operations like workqueue management.
The resolution involves modifying check_flush_dependency() to include a guard condition that verifies worker->current_pwq is not NULL before attempting to access its attributes. This ensures that if a kworker is present but not currently executing a specific work item, the function safely bypasses the WQ_MEM_RECLAIM diagnostic warning rather than crashing. It is important to note that this fix preserves the existing behavior for PF_MEMALLOC warnings, ensuring that explicit reclaim context flushing against non-reclaimable targets continues to be reported correctly. This targeted patch maintains system stability without suppressing legitimate error reporting mechanisms related to memory allocation contexts.
To mitigate risks associated with similar vulnerabilities in kernel development and maintenance, engineers should rigorously validate pointer states before dereferencing them, especially within interrupt handlers or asynchronous worker threads where execution context can change rapidly. Adhering to strict coding standards that mandate null checks for all dynamically allocated structures is essential. Furthermore, comprehensive testing under high memory pressure conditions helps expose edge cases in resource management logic. Security teams should ensure their systems are updated with the latest kernel patches addressing workqueue subsystem flaws to prevent potential denial of service attacks stemming from these low-level pointer errors. Regular auditing of kernel code paths that interact with OOM notifiers and dynamic allocation routines can further reduce the attack surface for such stability-critical vulnerabilities.