CVE-2026-23240: tls: Fix race condition in tls_sw_cancel_work_tx()
In the Linux kernel, the following vulnerability has been resolved:
tls: Fix race condition in tlsswcancelworktx()
This issue was discovered during a code audit.
After canceldelayedworksync() is called from tlsskprotoclose(), txworkhandler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the txworkhandler() worker may dereference a freed TLS object.
The following is a simple race scenario:
cpu0 cpu1
tlsskprotoclose() tlsswcancelworktx() tlswritespace() tlsswwritespace() if (!testandsetbit(BITTXSCHEDULED, &txctx->txbitmask)) setbit(BITTXSCHEDULED, &ctx->txbitmask); canceldelayedworksync(&ctx->txwork.work); scheduledelayedwork(&txctx->txwork.work, 0);
To prevent this race condition, canceldelayedworksync() is replaced with disabledelayedworksync().
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23240?
CVE-2026-23240 has been classified as a moderate severity vulnerability.
How do I fix CVE-2026-23240?
To fix CVE-2026-23240, you should update to the latest patched version of the Linux kernel.
What are the consequences of not addressing CVE-2026-23240?
Failure to address CVE-2026-23240 may lead to potential denial of service conditions due to the race condition.
Which versions of the Linux kernel are affected by CVE-2026-23240?
CVE-2026-23240 affects multiple versions of the Linux kernel that include the vulnerable code.
How was CVE-2026-23240 discovered?
CVE-2026-23240 was discovered during a routine code audit of the Linux kernel.