{"id":"CVE-2026-23372","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket.  rawsock_tx…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.1.1, < 5.10.253","linux_kernel >= 5.11, < 5.15.203","linux_kernel >= 5.16, < 6.1.167","linux_kernel >= 6.2, < 6.6.130","linux_kernel >= 6.7, < 6.12.77","linux_kernel >= 6.13, < 6.18.17","linux_kernel >= 6.19, < 6.19.7","linux_kernel = 3.1","linux_kernel = 7.0"],"patched":["linux_kernel 6.19.7"],"published":"2026-03-25","updated":"2026-10-15","sourceUpdated":"2026-10-15T02:18:52.950","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-23372","references":[{"url":"https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-784472.html","label":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}],"tags":["nvd","cve.org"],"epss":0.00132,"epssPercentile":0.02457,"ingestedAt":"2026-10-15T03:30:12.846Z","slug":"CVE-2026-23372","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfc: rawsock: cancel tx_work before socket teardown\n\nIn rawsock_release(), cancel any pending tx_work and purge the write\nqueue before orphaning the socket.  rawsock_tx_work runs on the system\nworkqueue and calls nfc_data_exchange which dereferences the NCI\ndevice.  Without synchronization, tx_work can race with socket and\ndevice teardown when a process is killed (e.g. by SIGKILL), leading\nto use-after-free or leaked references.\n\nSet SEND_SHUTDOWN first so that if tx_work is already running it will\nsee the flag and skip transmitting, then use cancel_work_sync to wait\nfor any in-progress execution to finish, and finally purge any\nremaining queued skbs.\n\n## Affected\n\n- `linux_kernel >= 3.1.1, < 5.10.253`\n- `linux_kernel >= 5.11, < 5.15.203`\n- `linux_kernel >= 5.16, < 6.1.167`\n- `linux_kernel >= 6.2, < 6.6.130`\n- `linux_kernel >= 6.7, < 6.12.77`\n- `linux_kernel >= 6.13, < 6.18.17`\n- `linux_kernel >= 6.19, < 6.19.7`\n- `linux_kernel = 3.1`\n- `linux_kernel = 7.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 6.19.7`","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}