In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL current_pwq deref in flush dependency check… (CVE-2026-98537)

The Linux kernel vulnerability CVE-2026-98537 involves a NULL pointer dereference in the workqueue subsystem's flush dependency check. Specifically, check_flush_dependency() uses current_wq_worker() to identify if the caller is a workqueue worker and then dereferences worker->current_pwq to check if the current workqueue is WQ_MEM_RECLAIM. However, current_wq_worker() only indicates that the current task has PF_WQ_WORKER set, not that it is actively executing a work item. In some execution paths, such as when the worker_thread() acts as a pool manager during GFP_KERNEL allocations that trigger OOM notifiers, worker->current_pwq can be NULL because it is only set during process_one_work() execution. The fix adds a guard to ensure worker->current_pwq is non-NULL before dereferencing, preventing the NULL pointer dereference and associated warnings.

This vulnerability could cause kernel warnings or instability due to dereferencing a NULL pointer in the workqueue flush dependency check. It affects kernel stability during memory reclaim and allocation paths involving workqueue workers. There is no indication of remote code execution or privilege escalation from the provided data.

A fix is available that adds a guard to check that worker->current_pwq is non-NULL before dereferencing in check_flush_dependency(). Users should update to the patched Linux kernel version that includes this fix. No additional mitigations are indicated.