CVE-2026-23372: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23372 is a race condition vulnerability in the Linux kernel's NFC rawsock implementation, specifically in the rawsock_release() socket teardown path. When a process is killed (e.g., by SIGKILL), the rawsock_tx_work function running on the system workqueue can race with socket and device teardown, as it dereferences the NCI device without proper synchronization, leading to use-after-free or leaked references. The vulnerability affects Linux kernel versions from 3.1.1 through multiple stable branches up to 6.19.6 and 7.0-rc2. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, Feedly).

The root cause is classified as CWE-364 (Signal Handler Race Condition). In rawsock_release(), the pending tx_work was not cancelled and the write queue was not purged before orphaning the socket. Since rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange() — which dereferences the NCI device — a race window exists between workqueue execution and socket/device teardown triggered by process termination signals like SIGKILL. The fix sets the SEND_SHUTDOWN flag first so any in-progress tx_work skips transmission, then calls cancel_work_sync() to wait for completion, and finally purges remaining queued socket buffers (skbs) (Red Hat CVE, Kernel Patch).

Successful exploitation can result in use-after-free memory corruption or leaked kernel references, potentially enabling a local attacker to cause a kernel crash (denial of service), disclose sensitive kernel memory, or escalate privileges. The CVSS assessment reflects high confidentiality, integrity, and availability impact. Systems with NFC hardware and the NFC subsystem enabled are at greatest risk; systems without NFC hardware or with the NFC subsystem disabled have significantly reduced exposure (Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation as of the time of this report. The vulnerability requires local access with low privileges (no user interaction needed), making it accessible to any unprivileged local user on an affected system with NFC enabled. The EPSS score is approximately 0.024%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Red Hat CVE, Feedly).

Update the Linux kernel to one of the following patched versions: 5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.77, 6.18.17, 6.19.7, or 7.0-rc3 and later. Patches are available via the upstream kernel stable tree and have been incorporated into distributions including Debian (DSA-6243-1, DLA-4561-1) and SUSE (SUSE-SU-2026:2217-1, SUSE-SU-2026:2238-1). As a workaround, disabling or blacklisting the NFC subsystem (modprobe -r nfc) on systems that do not require NFC functionality reduces exposure (Red Hat CVE, Kernel Patch, SUSE Advisory).

Red Hat has tracked this vulnerability and published a CVE advisory page. Debian has issued security advisories (DSA-6243-1 and DLA-4561-1) addressing this issue in their kernel packages. SUSE has released security updates (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1). No notable independent researcher commentary or significant social media discussion has been observed beyond standard distribution security channels (Red Hat CVE, Debian Advisory, SUSE Advisory).