CVE-2026-23372High· 7.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx…

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score43/ 100 · Moderate

impact 42.9 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 25, 2026

Updated

Oct 15, 2026

CVSS

7.8

Vendor

linux

Product

linux_kernel

CWE

—

Depth score

43 · Moderate

EPSS

0.13% · p2

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 204 days

Mar 25, 2026Published
Disclosed via NVD
Oct 15, 2026Record revised
Last analysed / modified upstream
Oct 15, 2026EPSS first tracked
0.1%

linux #nvd

Affected

linux_kernel >= 3.1.1, < 5.10.253
linux_kernel >= 5.11, < 5.15.203
linux_kernel >= 5.16, < 6.1.167
linux_kernel >= 6.2, < 6.6.130
linux_kernel >= 6.7, < 6.12.77
linux_kernel >= 6.13, < 6.18.17
linux_kernel >= 6.19, < 6.19.7
linux_kernel = 3.1
linux_kernel = 7.0

Patched in

linux_kernel 6.19.7

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

nfc: rawsock: cancel tx_work before socket teardown

In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.

Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.

Affected

linux_kernel >= 3.1.1, < 5.10.253
linux_kernel >= 5.11, < 5.15.203
linux_kernel >= 5.16, < 6.1.167
linux_kernel >= 6.2, < 6.6.130
linux_kernel >= 6.7, < 6.12.77
linux_kernel >= 6.13, < 6.18.17
linux_kernel >= 6.19, < 6.19.7
linux_kernel = 3.1
linux_kernel = 7.0

Remediation

Upgrade past the affected range:

linux_kernel 6.19.7

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd