{"id":"CVE-2026-23239","title":"espintcp: Fix race condition in espintcp_close()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: Fix race condition in espintcp_close()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_work_sync() is called from espintcp_close(),\nespintcp_tx_…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < f7ad8b1d0e421c524604d5076b73232093490d5c","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 664e9df53226b4505a0894817ecad2c610ab11d8","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 022ff7f347588de6e17879a1da6019647b21321b","Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < e1512c1db9e8794d8d130addd2615ec27231d994","Linux 5.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:06:50.245175Z"},"published":"2026-03-10","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:09:50.691Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23239","references":[{"url":"https://git.kernel.org/stable/c/f7ad8b1d0e421c524604d5076b73232093490d5c"},{"url":"https://git.kernel.org/stable/c/664e9df53226b4505a0894817ecad2c610ab11d8"},{"url":"https://git.kernel.org/stable/c/022ff7f347588de6e17879a1da6019647b21321b"},{"url":"https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994"}],"tags":["cve.org"],"epss":0.00105,"epssPercentile":0.01025,"ingestedAt":"2026-10-16T17:24:46.641Z","slug":"CVE-2026-23239","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nespintcp: Fix race condition in espintcp_close()\n\nThis issue was discovered during a code audit.\n\nAfter cancel_work_sync() is called from espintcp_close(),\nespintcp_tx_work() can still be scheduled from paths such as\nthe Delayed ACK handler or ksoftirqd.\nAs a result, the espintcp_tx_work() worker may dereference a\nfreed espintcp ctx or sk.\n\nThe following is a simple race scenario:\n\n           cpu0                             cpu1\n\n  espintcp_close()\n    cancel_work_sync(&ctx->work);\n                                     espintcp_write_space()\n                                       schedule_work(&ctx->work);\n\nTo prevent this race condition, cancel_work_sync() is\nreplaced with disable_work_sync().\n\n## Affected\n\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < f7ad8b1d0e421c524604d5076b73232093490d5c`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 664e9df53226b4505a0894817ecad2c610ab11d8`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 022ff7f347588de6e17879a1da6019647b21321b`\n- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < e1512c1db9e8794d8d130addd2615ec27231d994`\n- `Linux 5.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}