CVE-2026-23239: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23239 is a race condition vulnerability in the Linux kernel's espintcp_close() function within the ESP-in-TCP (Encapsulating Security Payload over TCP) subsystem. Discovered during a code audit and disclosed on March 10, 2026, the flaw allows a local attacker with low privileges to trigger a use-after-free condition by exploiting a timing window between cancel_work_sync() and subsequent worker scheduling via the Delayed ACK handler or ksoftirqd. Affected kernel versions span from 5.6 up to (but not including) 6.12.75, 6.13 through 6.18.16, and 6.19 through 6.19.6, as well as 7.0-rc1. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is improper synchronization (CWE-362) in espintcp_close(): after cancel_work_sync(&ctx->work) completes, the espintcp_write_space() callback — triggered by network events such as Delayed ACK processing or ksoftirqd — can call schedule_work(&ctx->work), re-queuing espintcp_tx_work() after the context has already been freed. This creates a use-after-free condition where the worker dereferences a freed espintcp context (ctx) or socket structure (sk). The fix replaces cancel_work_sync() with disable_work_sync(), which prevents the work item from being re-scheduled after cancellation (Red Hat Bugzilla, Feedly). Researchers have identified this as part of a broader "out-of-cancel" bug class in the Linux kernel (core-jmp.org).

Successful exploitation can result in a kernel crash (denial of service) or, in more sophisticated scenarios, arbitrary kernel code execution due to the use-after-free condition. The vulnerability is locally exploitable by a low-privileged user on systems that actively use the espintcp subsystem for IPsec-over-TCP connections. Confidentiality, integrity, and availability are all rated HIGH, meaning a successful exploit could expose sensitive kernel memory, corrupt kernel state, or crash the system entirely (Red Hat Advisory, Feedly).

1. Identify a vulnerable target: Confirm the target system runs a Linux kernel version between 5.6 and 6.12.74, 6.13–6.18.15, or 6.19–6.19.5, and that the espintcp module is loaded (used for IPsec-over-TCP connections).
2. Obtain local access: Gain a low-privileged local shell on the target system (e.g., via SSH, container escape, or existing foothold).
3. Set up espintcp context: Establish or trigger an ESP-in-TCP connection to create an espintcp context and associated work queue entry (ctx->work).
4. Race the close path: Trigger espintcp_close() on one CPU (e.g., by closing the IPsec socket) while simultaneously generating network traffic that causes espintcp_write_space() to be called on another CPU (e.g., via Delayed ACK events or softirq processing), re-scheduling espintcp_tx_work() after cancel_work_sync() has returned.
5. Trigger use-after-free: The re-scheduled espintcp_tx_work() worker dereferences the already-freed ctx or sk, resulting in a kernel crash or, with careful heap manipulation, potential kernel code execution (Red Hat Bugzilla, core-jmp.org).

• Logs: Kernel oops or BUG messages in /var/log/kern.log or dmesg referencing espintcp_tx_work, use-after-free, or invalid memory access in the espintcp subsystem.
• Logs: Kernel panic traces involving espintcp_close(), cancel_work_sync(), or schedule_work() in the call stack.
• Process: Unexpected kernel worker threads (kworker) consuming CPU in relation to espintcp or IPsec-over-TCP processing.
• Network: Unusual or repeated TCP connections on ports associated with IPsec-over-TCP (typically port 4500) coinciding with system instability or crashes.
• File System: Kernel crash dump files (vmcore) generated in /var/crash/ or configured crash dump directories following unexpected reboots.

Update the Linux kernel to a patched version: 6.12.75, 6.18.16, 6.19.6, or 7.0-rc2 (or later). Patches are available via upstream kernel commits at git.kernel.org (commits 022ff7f3, 664e9df5, e1512c1d, f7ad8b1d). Distribution-specific updates have been released for Amazon Linux 2023, Debian (DSA-6238-1, kernel 6.12.85), SUSE (SUSE-SU-2026:2111-1, 2195-1, 2215-1, 2238-1), and openSUSE. As a temporary workaround where patching is not immediately possible, disabling or avoiding use of the espintcp module (IPsec-over-TCP) reduces exposure (Red Hat Bugzilla, Amazon Linux Advisory, SUSE Advisory).

Security researcher v4bel published a technical write-up on March 23, 2026, analyzing the vulnerability in the context of Linux kernel race conditions (v4bel Blog). The core-jmp.org blog characterized this as a representative example of a new "out-of-cancel" Linux kernel race condition bug class, suggesting broader systemic implications beyond this single CVE (core-jmp.org). Security newsletter author grugq highlighted the vulnerability in a March 25, 2026 edition, indicating moderate community interest (grugq Newsletter).