{
  "cveId": "CVE-2026-99103",
  "url": "https://patchblox.com/security/cve/CVE-2026-99103",
  "summary": "CVE-2026-99103 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99103, released November 3, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix unbound pool lifetime for pending...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix unbound pool lifetime for pending pwqs  KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq():    BUG: KASAN: slab-use-after-free in _raw_spin_trylock\u002B0x6d/0x120   Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318    CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)   Hardware name: QEMU Standard PC (i440FX \u002B PIIX, 1996), BIOS 1.15.0-1 04/01/2014   Workqueue:  0x0 (flush-8:0)   Call Trace:    \u003CTASK\u003E    dump_stack_lvl\u002B0x53/0x70    print_report\u002B0xce/0x610    kasan_report\u002B0xce/0x100    _raw_spin_trylock\u002B0x6d/0x120    pwq_dec_nr_in_flight\u002B0x4b4/0xcb0    process_one_work\u002B0x921/0x11a0    worker_thread\u002B0x4d0/0xd20    kthread\u002B0x2de/0x3c0    ret_from_fork\u002B0x3aa/0x620    ret_from_fork_asm\u002B0x1a/0x30    \u003C/TASK\u003E    Allocated by task 311:    alloc_pwq\u002B0x439/0xca0    apply_wqattrs_prepare\u002B0x75e/0xd10    apply_workqueue_attrs_locked\u002B0x44/0xa0    wq_nice_store\u002B0x350/0x450    Freed by task 0:    kfree\u002B0x127/0x3b0    rcu_core\u002B0x523/0x1780    handle_softirqs\u002B0x1b3/0x610    Last potentially related work creation:    put_unbound_pool\u002B0x3f3/0x7d0    pwq_release_workfn\u002B0x494/0x8e0    kthread_worker_fn\u002B0x1ff/0x790  Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool-\u003Elock.  Remove the pwq from pending_pwqs before putting the pool.",
  "published": "2026-10-28T11:17:29Z",
  "severity": "",
  "epss": 0.00173,
  "epssPercentile": 0.06791,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-99103",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99103",
      "released": "2026-11-03T18:58:21Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.13-1",
      "fix": "DEBIAN-CVE-2026-99103",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99103",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}