{"id":41009,"date":"2026-10-19T00:31:49","date_gmt":"2026-10-18T16:31:49","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98537"},"modified":"2026-10-19T00:31:49","modified_gmt":"2026-10-18T16:31:49","slug":"cve-2026-98537","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-98537","title":{"rendered":"CVE-2026-98537 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nworkqueue: Fix NULL c"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>workqueue: Fix NULL current_pwq deref in flush dependency check<\/p>\n<p>check_flush_dependency() uses current_wq_worker() to determine whether<br \/>\nthe caller is a workqueue worker and then dereferences worker-&gt;current_pwq<br \/>\nto test whether the current workqueue is WQ_MEM_RECLAIM.<\/p>\n<p>current_wq_worker() only means that %current has PF_WQ_WORKER set. A<br \/>\nkworker can reach check_flush_dependency() while it is not executing a<br \/>\nwork item. One such path is worker_thread() acting as the pool manager,<br \/>\nwhere create_worker() does GFP_KERNEL allocation and the allocation path<br \/>\ninvokes the OOM notifier. In that state worker-&gt;current_pwq is NULL<br \/>\nbecause current_pwq is set only by process_one_work() and cleared again<br \/>\nafter the work function returns.<\/p>\n<p>[  416.760634][  T375] Call trace:<br \/>\n[  416.760638][  T375]  check_flush_dependency+0x80\/0x120 (P)<br \/>\n[  416.760648][  T375]  __flush_work+0x98\/0x224<br \/>\n[  416.760657][  T375]  flush_work+0x30\/0x44<br \/>\n[  416.760665][  T375]  &#8230;<br \/>\n[  416.760710][  T375]  blocking_notifier_call_chain+0x58\/0xa0<br \/>\n[  416.760719][  T375]  out_of_memory+0xb4\/0x458<br \/>\n[  416.760730][  T375]  __alloc_pages_may_oom+0x11c\/0x1a8<br \/>\n[  416.760739][  T375]  __alloc_pages_slowpath+0x314\/0x46c<br \/>\n[  416.760746][  T375]  __alloc_frozen_pages_noprof+0x110\/0x1a4<br \/>\n[  416.760753][  T375]  new_slab+0x12c\/0x484<br \/>\n[  416.760759][  T375]  ___slab_alloc+0x7a8\/0xc7c<br \/>\n[  416.760765][  T375]  __slab_alloc+0x74\/0xd8<br \/>\n[  416.760772][  T375]  __kmalloc_cache_node_noprof+0x2ac\/0x304<br \/>\n[  416.760779][  T375]  alloc_worker+0x28\/0x60<br \/>\n[  416.760785][  T375]  create_worker+0x4c\/0x20c<br \/>\n[  416.760790][  T375]  worker_thread+0xe8\/0x2b8<br \/>\n[  416.760796][  T375]  kthread+0x1a8\/0x200<br \/>\n[  416.760805][  T375]  ret_from_fork+0x10\/0x20<\/p>\n<p>Guard the WQ_MEM_RECLAIM-worker warning with worker-&gt;current_pwq. If the<br \/>\nkworker is not currently executing a work item, there is no current<br \/>\nworkqueue to diagnose with that warning. The PF_MEMALLOC warning is left<br \/>\nunchanged so explicit reclaim context flushing a !WQ_MEM_RECLAIM target<br \/>\nis still reported.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>workqueue: Fix NULL current_pwq deref in flush dependency check<\/p>\n<p>check_flush_dependency() uses current_wq_worker() to determine whe<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41009","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41009","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41009"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41009"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41009"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}