CVE-2026-23372: nfc: rawsock: cancel tx_work before socket teardown
In the Linux kernel, the following vulnerability has been resolved:
nfc: rawsock: cancel txwork before socket teardown
In rawsockrelease(), cancel any pending txwork and purge the write queue before orphaning the socket. rawsocktxwork runs on the system workqueue and calls nfcdataexchange which dereferences the NCI device. Without synchronization, txwork can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.
Set SENDSHUTDOWN first so that if txwork is already running it will see the flag and skip transmitting, then use cancelworksync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
In rawsock_release(), set SEND_SHUTDOWN before socket teardown, call cancel_work_sync on tx_work to wait for in-progress execution to finish, purge the remaining queued skbs from the write queue, and only then orphan the socket.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23372?
The severity of CVE-2026-23372 is currently classified as high due to its potential impact on Linux kernel networking functions.
How do I fix CVE-2026-23372?
To fix CVE-2026-23372, update the Linux kernel to a version where this vulnerability has been resolved by the maintainers.
What kind of systems are affected by CVE-2026-23372?
CVE-2026-23372 affects systems running vulnerable versions of the Linux kernel that utilize raw socket communication.
What are the potential consequences of CVE-2026-23372?
The potential consequences of CVE-2026-23372 include potential denial of service and instability in networking operations due to improper handling of raw sockets.
When was CVE-2026-23372 disclosed?
CVE-2026-23372 was disclosed as part of a routine security update in the Linux kernel development.