CVE-2026-23240

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tls: Fix race condition in tls_sw_cancel_work_tx()

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(),

tx_work_handler() can still be scheduled from paths such as the

Delayed ACK handler or ksoftirqd.

As a result, the tx_work_handler() worker may dereference a freed

TLS object.

The following is a simple race scenario:

cpu0 cpu1

tls_sk_proto_close()

tls_sw_cancel_work_tx()

tls_write_space()

tls_sw_write_space()

if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))

set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);

cancel_delayed_work_sync(&ctx->tx_work.work);

schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References