CVE record · CVE-2026-99103

workqueue: Fix unbound pool lifetime for pending pwqs

No CVSS scoreEPSS 0.0017 · 6th percentile

Published by the CVE Program (CNA: Linux) at 28 Oct 2026, 10:34 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
Vendor	Product	Versions
Linux	Linux	affected 5a70baec2294e8a7d0fcc4558741c23e752dad5c to before 6741dd3fd38e47c08bc39d11ef5fa141fa6d0441 git affected 843288afd3cc6f3342659c6cf81fc47684d25563 to before 9f5d5aef3072a33c6f9bfb954bb0cba1c2541849 git affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before 390b9542fe670b8936738140ef9f349df6adeab6 git affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before f320b85c90fe5fc9d4d06badd450518323a94a7f git affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before 3d2ef2b9f4c084ab498494d26495a82f7e15407b git affected 5797b1c18919cd9c289ded7954383e499f729ce0 to before cf9c8aaea0d47410df8708bec195889f3a85cd3c git affected fc67aebe34f22632ccb22faea48cc4d3134620a2 git affected 6.6.23 to before 6.6.25 semver affected 6.8.2 to before 6.8.4 semver affected 6.7.11 to before 6.8 semver Other versions: unaffected
Linux	Linux	affected 6.9 unaffected before 6.9 semver unaffected 6.6.25 to 6.6., inclusive semver unaffected 6.8.4 to 6.8., inclusive semver unaffected 6.12.115 to 6.12., inclusive semver unaffected 6.18.59 to 6.18., inclusive semver unaffected 7.2.13 to 7.2., inclusive semver unaffected 7.3 to , inclusive original_commit_for_fix Other versions: affected

Identifiers: CVE-2026-99103
CNA: Linux
Tags: Linux kernel
Published: 28 Oct 2026
Updated: 30 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

No source has published a CVSS score for this record yet.

CISA KEV Not listed.
EPSS 0.0017, the 6th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 28 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.