CRITICAL
tls WorkQueue Race
CVE-2026-23240
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().
02KernelScan AI Analysis
Risk summary
A use-after-free condition in the TLS subsystem allows a worker thread to access freed TLS objects during socket closure, potentially leading to memory corruption or information disclosure. This affects systems using kernel TLS offload for encrypted network connections and requires local access with low privileges to trigger.
Vulnerability analysis
The root cause is a TOCTOU race between tls_sk_proto_close() canceling the TX work queue and concurrent paths such as the Delayed ACK handler or ksoftirqd scheduling new work. After cancel_delayed_work_sync() completes, tx_work_handler() can still be scheduled, causing it to dereference the freed TLS context object. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() to prevent any future scheduling of the work item, eliminating the race window. The exploitable primitive is a use-after-free in kernel heap memory, which can be reached by applications with access to TLS sockets.
03Fix Versions
| Branch | Fixed in | Patch commit |
|---|---|---|
| 6.12 | 6.12.75 | a5de36d6cee7 |
| 6.18 | 6.18.16 | 854cd32bc74f |
| 6.19 | 6.19.6 | 17153f154f80 |
| mainline | 7.0 | 7bb09315f93d |