{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  workqueue: Fix unbound pool lifetime for pending pwqs  KASAN reports a use-after-free of an unbound worker_pool in node_activate_pending_pwq():    BUG: KASAN: slab-use-after-free in _raw_spin_trylock+0x6d/0x120   Read of size 4 at addr ffff8880089ce000 by task kworker/u22:0/318    CPU: 1 UID: 0 PID: 318 Comm: kworker/u22:0 Not tainted 7.2.0 #1 PREEMPT(lazy)   Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014   Workqueue:  0x0 (flush-8:0)   Call Trace:    \u003cTASK\u003e    dump_stack_lvl+0x53/0x70    print_report+0xce/0x610    kasan_report+0xce/0x100    _raw_spin_trylock+0x6d/0x120    pwq_dec_nr_in_flight+0x4b4/0xcb0    process_one_work+0x921/0x11a0    worker_thread+0x4d0/0xd20    kthread+0x2de/0x3c0    ret_from_fork+0x3aa/0x620    ret_from_fork_asm+0x1a/0x30    \u003c/TASK\u003e    Allocated by task 311:    alloc_pwq+0x439/0xca0    apply_wqattrs_prepare+0x75e/0xd10    apply_workqueue_attrs_locked+0x44/0xa0    wq_nice_store+0x350/0x450    Freed by task 0:    kfree+0x127/0x3b0    rcu_core+0x523/0x1780    handle_softirqs+0x1b3/0x610    Last potentially related work creation:    put_unbound_pool+0x3f3/0x7d0    pwq_release_workfn+0x494/0x8e0    kthread_worker_fn+0x1ff/0x790  Canceling the last inactive work skips pwq_dec_nr_active(), so an empty pwq can remain on pending_pwqs when its refcnt reaches zero. pwq_release_workfn() currently puts the pool before removing that pwq. If this drops the last pool reference, the pool can be RCU-freed while the pwq remains reachable, and node_activate_pending_pwq() may trylock the freed pool-\u003elock.  Remove the pwq from pending_pwqs before putting the pool.",
  "id": "DEBIAN-CVE-2026-99103",
  "modified": "2026-10-29T05:47:22.767765957Z",
  "published": "2026-10-28T11:17:29.593Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-99103"
    }
  ],
  "upstream": [
    "CVE-2026-99103"
  ]
}