CVE-2026-23240
published 2026-03-10CVE-2026-23240: In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code…
PriorityP347critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.49%
38.9th percentile
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work(&tx_ctx->tx_work.work, 0);
To prevent this race condition, cancel_delayed_work_sync() is
replaced with disable_delayed_work_sync().
Affected
16 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.6-1 (forky) | linux 6.19.6-1 (forky) |
| linux | linux | — | — |
| linux | linux | >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < a5de36d6cee74a92c1a21b260bc507e64bc451de | a5de36d6cee74a92c1a21b260bc507e64bc451de |
| linux | linux | >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 854cd32bc74fe573353095e90958490e4e4d641b | 854cd32bc74fe573353095e90958490e4e4d641b |
| linux | linux | >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 17153f154f80be2b47ebf52840f2d8f724eb2f3b | 17153f154f80be2b47ebf52840f2d8f724eb2f3b |
| linux | linux | >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 7bb09315f93dce6acc54bf59e5a95ba7365c2be4 | 7bb09315f93dce6acc54bf59e5a95ba7365c2be4 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.6-1 | 6.19.6-1 |
| linux | linux_kernel | >= 5.3.0 < 6.12.75 | 6.12.75 |
| linux | linux_kernel | >= 5.3.1 < 6.12.75 | 6.12.75 |
| linux | linux_kernel | >= 6.13 < 6.18.16 | 6.18.16 |
| linux | linux_kernel | >= 6.13.0 < 6.18.16 | 6.18.16 |
| linux | linux_kernel | >= 6.19 < 6.19.6 | 6.19.6 |
| linux | linux_kernel | >= 6.19.0 < 6.19.6 | 6.19.6 |
| msrc | azl3_kernel_6.6.126.1-1_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian9.8CRITICAL
vendor_redhat9.8CRITICAL
vendor_msrc7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
tls: Fix race condition in tls_sw_cancel_work_tx()
osv·2026-03-10·CVSS 9.8
CVE-2026-23240 [CRITICAL] tls: Fix race condition in tls_sw_cancel_work_tx()
tls: Fix race condition in tls_sw_cancel_work_tx()
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work(&tx_ctx->tx_work.wor
GHSA
GHSA-c96v-vvf3-2p7r: In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered dur
ghsa_unreviewed·2026-03-10
CVE-2026-23240 [CRITICAL] GHSA-c96v-vvf3-2p7r: In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered dur
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work(&tx_ctx->tx_work.work, 0);
To prevent this race condition, cancel_delay
OSV
CVE-2026-23240: In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered durin
osv·2026-03-10·CVSS 9.8
CVE-2026-23240 [CRITICAL] CVE-2026-23240: In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered durin
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work
Microsoft
tls: Fix race condition in tls_sw_cancel_work_tx()
vendor_msrc·2026-03-10·CVSS 7.0
CVE-2026-23240 [CRITICAL] tls: Fix race condition in tls_sw_cancel_work_tx()
tls: Fix race condition in tls_sw_cancel_work_tx()
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Red Hat
kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
vendor_redhat·2026-03-10·CVSS 9.8
CVE-2026-23240 [CRITICAL] CWE-366 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delay
Debian
CVE-2026-23240: linux - In the Linux kernel, the following vulnerability has been resolved: tls: Fix ra...
vendor_debian·2026·CVSS 9.8
CVE-2026-23240 [CRITICAL] CVE-2026-23240: linux - In the Linux kernel, the following vulnerability has been resolved: tls: Fix ra...
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-23240 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
bugzilla·2026-03-10·CVSS 9.8
CVE-2026-23240 [CRITICAL] CVE-2026-23240 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
CVE-2026-23240 kernel: Linux kernel: Denial of service due to a race condition in the TLS subsystem
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.
Wiz
CVE-2026-23240 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 9.8
CVE-2026-23240 [CRITICAL] CVE-2026-23240 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-23240 :
Linux Kernel vulnerability analysis and mitigation
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work
2026-03-10
Published