CVE-2026-23239 espintcp: Fix race condition in espintcp_close()
A race condition in the Linux kernel's espintcp module allows a use-after-free, potentially causing a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23239?
CVE-2026-23239 is a high-severity vulnerability in Linux kernel, published on 10 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
espintcp: Fix race condition in espintcp_close()
This issue was discovered during a code audit.
After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may dereference a freed espintcp ctx or sk.
The following is a simple race scenario:
cpu0 cpu1
espintcp_close() cancel_work_sync(&ctx->work); espintcp_write_space() schedule_work(&ctx->work);
To prevent this race condition, cancel_work_sync() is replaced with disable_work_sync().
Weakness: CWE-362
Which versions are affected by CVE-2026-23239?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23239?
Apply the vendor's patch.
Is CVE-2026-23239 being exploited?
There is no known exploitation of CVE-2026-23239 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-23239, DEBIAN-CVE-2026-23239, GHSA-246x-p35q-qhcq, ROOT-OS-DEBIAN-11-CVE-2026-23239, ROOT-OS-DEBIAN-12-CVE-2026-23239, ROOT-OS-DEBIAN-13-CVE-2026-23239 and 3 more.