---
id: CVE-2026-23240
title: 'tls: Fix race condition in tls_sw_cancel_work_tx()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tls: Fix race condition in tls_sw_cancel_work_tx()

  This issue was discovered during a code audit.

  After cancel_delayed_work_sync() is called from tls_sk_proto_close()…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 <
    a5de36d6cee74a92c1a21b260bc507e64bc451de
  - >-
    Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 <
    854cd32bc74fe573353095e90958490e4e4d641b
  - >-
    Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 <
    17153f154f80be2b47ebf52840f2d8f724eb2f3b
  - >-
    Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 <
    7bb09315f93dce6acc54bf59e5a95ba7365c2be4
  - Linux 5.3
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:06:53.340021Z'
published: '2026-03-10'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:50.834Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23240'
references:
  - url: 'https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de'
  - url: 'https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b'
  - url: 'https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b'
  - url: 'https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4'
tags:
  - cve.org
epss: 0.00509
epssPercentile: 0.42139
ingestedAt: '2026-10-16T17:24:46.642Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tls: Fix race condition in tls_sw_cancel_work_tx()

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.

The following is a simple race scenario:

          cpu0                         cpu1

tls_sk_proto_close()
  tls_sw_cancel_work_tx()
                                 tls_write_space()
                                   tls_sw_write_space()
                                     if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
    set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
    cancel_delayed_work_sync(&ctx->tx_work.work);
                                     schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync() is
replaced with disable_delayed_work_sync().

## Affected

- `Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < a5de36d6cee74a92c1a21b260bc507e64bc451de`
- `Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 854cd32bc74fe573353095e90958490e4e4d641b`
- `Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 17153f154f80be2b47ebf52840f2d8f724eb2f3b`
- `Linux >= f87e62d45e51b12d48d2cb46b5cde8f83b866bc4 < 7bb09315f93dce6acc54bf59e5a95ba7365c2be4`
- `Linux 5.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.