---
id: CVE-2026-23239
title: 'espintcp: Fix race condition in espintcp_close()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  espintcp: Fix race condition in espintcp_close()

  This issue was discovered during a code audit.

  After cancel_work_sync() is called from espintcp_close(),
  espintcp_tx_…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    f7ad8b1d0e421c524604d5076b73232093490d5c
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    664e9df53226b4505a0894817ecad2c610ab11d8
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    022ff7f347588de6e17879a1da6019647b21321b
  - >-
    Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 <
    e1512c1db9e8794d8d130addd2615ec27231d994
  - Linux 5.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:50.245175Z'
published: '2026-03-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:50.691Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23239'
references:
  - url: 'https://git.kernel.org/stable/c/f7ad8b1d0e421c524604d5076b73232093490d5c'
  - url: 'https://git.kernel.org/stable/c/664e9df53226b4505a0894817ecad2c610ab11d8'
  - url: 'https://git.kernel.org/stable/c/022ff7f347588de6e17879a1da6019647b21321b'
  - url: 'https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994'
tags:
  - cve.org
epss: 0.00105
epssPercentile: 0.01025
ingestedAt: '2026-10-16T17:24:46.641Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

espintcp: Fix race condition in espintcp_close()

This issue was discovered during a code audit.

After cancel_work_sync() is called from espintcp_close(),
espintcp_tx_work() can still be scheduled from paths such as
the Delayed ACK handler or ksoftirqd.
As a result, the espintcp_tx_work() worker may dereference a
freed espintcp ctx or sk.

The following is a simple race scenario:

           cpu0                             cpu1

  espintcp_close()
    cancel_work_sync(&ctx->work);
                                     espintcp_write_space()
                                       schedule_work(&ctx->work);

To prevent this race condition, cancel_work_sync() is
replaced with disable_work_sync().

## Affected

- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < f7ad8b1d0e421c524604d5076b73232093490d5c`
- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 664e9df53226b4505a0894817ecad2c610ab11d8`
- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < 022ff7f347588de6e17879a1da6019647b21321b`
- `Linux >= e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 < e1512c1db9e8794d8d130addd2615ec27231d994`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.