CVE-2026-23239
Race Condition in Linux espintcp_close() Risks Use-After-Free
Publication date: 2026-03-10
Last updated on: 2026-05-20
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.0 |
| linux | linux_kernel | From 6.13 (inc) to 6.18.16 (exc) |
| linux | linux_kernel | From 6.19 (inc) to 6.19.6 (exc) |
| linux | linux_kernel | From 5.6 (inc) to 6.12.75 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a race condition in the Linux kernel's espintcp component, specifically in the espintcp_close() function.
After the function cancel_work_sync() is called within espintcp_close(), the espintcp_tx_work() worker can still be scheduled from other paths like the Delayed ACK handler or ksoftirqd.
Because of this, the espintcp_tx_work() worker may attempt to dereference a freed espintcp context or socket (sk), which can lead to undefined behavior or crashes.
The fix involved replacing cancel_work_sync() with disable_work_sync() to properly prevent this race condition.
How can this vulnerability impact me? :
This race condition can cause the espintcp_tx_work() worker to dereference freed memory, potentially leading to system instability, crashes, or unexpected behavior in the Linux kernel's TCP stack.
Such instability could affect network communication reliability and overall system security, possibly resulting in denial of service or other operational issues.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is caused by a race condition in the espintcp_close() function of the Linux kernel. To mitigate this issue, the fix involves replacing cancel_work_sync() with disable_work_sync() in the espintcp_close() function.
Therefore, the immediate step to mitigate this vulnerability is to update your Linux kernel to a version where this fix has been applied.