PT-2026-24263 · Linux · Linux Kernel

Published

2026-01-01

·

Updated

2026-05-26

·

CVE-2026-23240

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)
Description The Linux kernel contains a race condition within the tls sw cancel work tx() function related to Transport Layer Security (TLS). A code audit identified that after cancel delayed work sync() is called from tls sk proto close(), the tx work handler() could still be scheduled through paths like the Delayed ACK handler or ksoftirqd. This could lead to the tx work handler() worker attempting to dereference a freed TLS object. The issue occurs due to a race condition between CPU0 and CPU1, where CPU0 calls tls sk proto close() and tls sw cancel work tx(), while CPU1 schedules tx work handler() via tls write space() and tls sw write space(). To address this, cancel delayed work sync() has been replaced with disable delayed work sync().
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

Related Identifiers

CVE-2026-23240
ECHO-D742-2DD2-8879
OESA-2026-1862
OESA-2026-1863
OESA-2026-1864
OPENSUSE-SU-2026:10387-1
OPENSUSE-SU-2026:20572-1
SUSE-SU-2026:2111-1
SUSE-SU-2026:21237-1
SUSE-SU-2026:21352-1
SUSE-SU-2026:21361-1
SUSE-SU-2026:21876-1
SUSE-SU-2026:21877-1
SUSE-SU-2026:21916-1
SUSE-SU-2026:21919-1
SUSE-SU-2026:2195-1
SUSE-SU-2026:2202-1
SUSE-SU-2026:2215-1
SUSE-SU-2026:2216-1
SUSE-SU-2026:2217-1
SUSE-SU-2026:2238-1

Affected Products

Linux Kernel