CVE-2026-23240: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23240 is a race condition vulnerability in the Linux kernel's TLS (Transport Layer Security) subsystem, specifically in the tls_sw_cancel_work_tx() function. Discovered during a code audit and disclosed on March 10, 2026, it affects Linux kernel versions from 5.3.1 up to (but not including) 6.12.75, from 6.13 up to (but not including) 6.18.16, from 6.19 up to (but not including) 6.19.6, and 7.0-rc1. The vulnerability is assigned a CVSS v3.1 base score of 9.8 (Critical) by Red Hat, though the actual exploitability characteristics suggest a more moderate real-world risk profile (Red Hat Bugzilla, Red Hat CVE).

The vulnerability is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization / Race Condition). After cancel_delayed_work_sync() is called from tls_sk_proto_close() during TLS socket closure, the tx_work_handler() worker can still be rescheduled via paths such as the Delayed ACK handler or ksoftirqd. Specifically, on CPU1, tls_sw_write_space() can call schedule_delayed_work() after CPU0 has already called cancel_delayed_work_sync(), causing tx_work_handler() to dereference a freed TLS context object — a classic use-after-free condition. The fix replaces cancel_delayed_work_sync() with disable_delayed_work_sync() to prevent re-scheduling after cancellation (Red Hat Bugzilla, Kernel Patch). A researcher blog post and a write-up describing this as a new Linux kernel race condition bug class were published in late March 2026 (v4bel blog, core-jmp.org).

Successful exploitation of this use-after-free race condition can result in a kernel crash (denial of service) or, in more severe scenarios, arbitrary code execution with kernel privileges. An unauthenticated remote attacker could trigger the vulnerability by establishing a TLS connection and manipulating socket closure timing to win the race, potentially leading to full system compromise. The vulnerability affects the confidentiality, integrity, and availability of the host system at the kernel level, with potential for privilege escalation and lateral movement if kernel code execution is achieved (Red Hat Bugzilla, Red Hat CVE).

• Logs: Unexpected kernel oops, panics, or BUG messages in /var/log/kern.log or dmesg output referencing tls_sw_cancel_work_tx, tx_work_handler, or use-after-free in the TLS subsystem.
• Process: Unusual kernel worker thread activity (kworker) associated with TLS socket operations during high-frequency TLS connection open/close cycles.
• Network: High volume of TLS connection establishment and teardown events from a single source, potentially indicative of attempts to trigger the race condition.

Update the Linux kernel to a patched version: 6.12.75 or later (for the 5.3.1–6.12.x branch), 6.18.16 or later (for the 6.13–6.18.x branch), 6.19.6 or later (for the 6.19.x branch), or 7.0-rc2 or later. Patches are available in the upstream kernel repository (Kernel Patch). Distribution-specific updates have been released by Red Hat, Debian (DSA-6238-1, linux 6.12.85), SUSE (SUSE-SU-2026:2111-1, 2195-1, 2215-1, 2238-1), openSUSE, Amazon Linux 2023 (ALAS2023-2026-1543, ALAS2023-2026-1702), and Oracle Linux. As a temporary workaround where patching is not immediately possible, consider restricting TLS connection establishment to trusted sources to reduce exposure (Red Hat Bugzilla, Red Hat CVE).

Security researchers noted this vulnerability as representative of a broader, newly identified Linux kernel race condition bug class dubbed "Out-of-Cancel" (OOC), where work items can be rescheduled after cancellation during object teardown (v4bel blog, core-jmp.org). The vulnerability received attention from multiple Linux distribution vendors, with rapid patch adoption across Debian, SUSE, Amazon Linux, and Oracle Linux. Red Hat triaged the issue as medium severity despite the high CVSS score, reflecting the practical difficulty of exploitation.