CVE-2026-23240 tls: Fix race condition in tls_sw_cancel_work_tx()
A race condition in the Linux kernel TLS implementation allows a use-after-free, potentially causing a system crash or denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23240?
CVE-2026-23240 is a critical vulnerability in Linux kernel, published on 10 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tls_sw_cancel_work_tx()
This issue was discovered during a code audit.
After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object.
The following is a simple race scenario:
cpu0 cpu1
tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0);
To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().
Weakness: CWE-362
Which versions are affected by CVE-2026-23240?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23240?
Apply the vendor's patch.
Is CVE-2026-23240 being exploited?
There is no known exploitation of CVE-2026-23240 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-79668, BELL-CVE-2026-23240, DEBIAN-CVE-2026-23240, GHSA-c96v-vvf3-2p7r, ROOT-OS-DEBIAN-11-CVE-2026-23240, ROOT-OS-DEBIAN-12-CVE-2026-23240 and 4 more.