Skip to content
OpenAdvisories
Critical · 9.8 CVE-2026-23240 EUVD-2026-10575GHSA-c96v-vvf3-2p7r

tls: Fix race condition in tls_sw_cancel_work_tx()

Published Mar 10, 2026 · Updated Oct 19, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.15 Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.17 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

tls: Fix race condition in tls_sw_cancel_work_tx()

This issue was discovered during a code audit.

After cancel_delayed_work_sync() is called from tls_sk_proto_close(),
tx_work_handler() can still be scheduled from paths such as the
Delayed ACK handler or ksoftirqd.
As a result, the tx_work_handler() worker may dereference a freed
TLS object.

The following is a simple race scenario:

cpu0 cpu1

tls_sk_proto_close()
tls_sw_cancel_work_tx()
tls_write_space()
tls_sw_write_space()
if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask))
set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask);
cancel_delayed_work_sync(&ctx->tx_work.work);
schedule_delayed_work(&tx_ctx->tx_work.work, 0);

To prevent this race condition, cancel_delayed_work_sync() is
replaced with disable_delayed_work_sync().

Affected products

VendorProductAffectedFixed
Linux Linux 5.3 6.12.75

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 6.19.6-1 —
Debian 13 linux 6.12.85-1 —
Debian 12 linux No fix yet —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield No fix yet —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield No fix yet —
Ubuntu 25.10 linux +8 No fix yet —
Ubuntu 24.04 LTS linux +43 No fix yet —
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1035.38 USN-8781-1
Ubuntu 22.04 LTS linux +59 No fix yet —
Show 12 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime +3 No fix yet —
Ubuntu Pro Realtime 22.04 LTS linux-realtime +2 No fix yet —
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux +21 No fix yet —
Ubuntu Pro 18.04 LTS linux-aws-5.4 +6 No fix yet —
ReleasePackageFixed inAdvisory
RHEL 10 rv +76 6.12.0-264.9.1.el10_3 RHSA-2026:97040
RHEL 9 rv +75 5.14.0-741.14.1.el9_9 RHSA-2026:97435
ReleasePackageFixed inAdvisory
SLES 15 SP7 kernel-64kb +7 6.4.0-150700.53.55.1 SUSE-SU-2026:2238-1
SLES 15 SP7 kernel-default-base 6.4.0-150700.53.55.1.150700.17.33.1 SUSE-SU-2026:2238-1
SLES 15 SP6 kernel-64kb +6 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLES 15 SP6 kernel-default-base 6.4.0-150600.23.112.1.150600.12.52.1 SUSE-SU-2026:2195-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP6 kernel-default-base 6.4.0-150600.23.112.1.150600.12.52.1 SUSE-SU-2026:2195-1
SLES for SAP 15 SP6 kernel-docs +4 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLE Micro 6.2 gdk-pixbuf 2.42.12-160000.4.1 SUSE-SU-2026:21230-1
SLE Micro 6.2 kernel-default-base 6.12.0-160000.27.1.160000.2.8 SUSE-SU-2026:21237-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_0 14-160000.3.4 SUSE-SU-2026:22975-1
SLE Micro 6.2 kernel-livepatch-SLE16-RT_Update_1 13-160000.1.1 SUSE-SU-2026:22974-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_0 16-160000.4.3 SUSE-SU-2026:22995-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_1 14-160000.1.1 SUSE-SU-2026:22993-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_2 12-160000.1.1 SUSE-SU-2026:22992-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_3 +1 11-160000.1.1 SUSE-SU-2026:22991-1, SUSE-SU-2026:22973-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_4 +2 10-160000.1.1 SUSE-SU-2026:22990-1, SUSE-SU-2026:22972-1, SUSE-SU-2026:22971-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_5 +1 9-160000.1.1 SUSE-SU-2026:22989-1, SUSE-SU-2026:22970-1
SLE Micro 6.2 kernel-livepatch-SLE16_Update_6 +1 8-160000.1.1 SUSE-SU-2026:22988-1, SUSE-SU-2026:22969-1
SLE Micro 6.2 kernel-rt +5 6.12.0-160000.28.1 SUSE-SU-2026:21237-1, SUSE-SU-2026:21230-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_10 19-1.1 SUSE-SU-2026:23426-1, SUSE-SU-2026:23105-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_13 +1 10-1.1 SUSE-SU-2026:23541-1, SUSE-SU-2026:23429-1, SUSE-SU-2026:23108-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0-RT_Update_22 4-1.2 SUSE-SU-2026:23435-1, SUSE-SU-2026:23097-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_10 +1 15-1.1 SUSE-SU-2026:23427-1, SUSE-SU-2026:23419-1, SUSE-SU-2026:23106-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_11 +2 14-1.1 SUSE-SU-2026:23428-1, SUSE-SU-2026:23423-1, SUSE-SU-2026:23422-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_13 12-1.1 SUSE-SU-2026:23424-1, SUSE-SU-2026:23090-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_14 10-1.2 SUSE-SU-2026:23421-1, SUSE-SU-2026:23089-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_16 +1 9-1.1 SUSE-SU-2026:23430-1, SUSE-SU-2026:23418-1, SUSE-SU-2026:23098-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_17 +1 8-1.1 SUSE-SU-2026:23431-1, SUSE-SU-2026:23425-1, SUSE-SU-2026:23104-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_18 +1 7-1.1 SUSE-SU-2026:23432-1, SUSE-SU-2026:23420-1, SUSE-SU-2026:23103-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_19 +1 5-1.1 SUSE-SU-2026:23433-1, SUSE-SU-2026:23416-1, SUSE-SU-2026:23102-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_20 +4 4-1.1 SUSE-SU-2026:23532-1, SUSE-SU-2026:23531-1, SUSE-SU-2026:23436-1
SLE Micro 6.1 kernel-livepatch-MICRO-6-0_Update_9 21-1.2 SUSE-SU-2026:23094-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_10 19-1.1 SUSE-SU-2026:23368-1, SUSE-SU-2026:23043-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_13 +1 10-1.1 SUSE-SU-2026:23482-1, SUSE-SU-2026:23371-1, SUSE-SU-2026:23046-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0-RT_Update_22 4-1.2 SUSE-SU-2026:23377-1, SUSE-SU-2026:23028-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_10 +1 15-1.1 SUSE-SU-2026:23383-1, SUSE-SU-2026:23369-1, SUSE-SU-2026:23044-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_11 +2 14-1.1 SUSE-SU-2026:23385-1, SUSE-SU-2026:23384-1, SUSE-SU-2026:23370-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_13 12-1.1 SUSE-SU-2026:23386-1, SUSE-SU-2026:23021-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_14 10-1.2 SUSE-SU-2026:23387-1, SUSE-SU-2026:23020-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_16 +1 9-1.1 SUSE-SU-2026:23388-1, SUSE-SU-2026:23372-1, SUSE-SU-2026:23029-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_17 +1 8-1.1 SUSE-SU-2026:23389-1, SUSE-SU-2026:23373-1, SUSE-SU-2026:23035-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_18 +1 7-1.1 SUSE-SU-2026:23390-1, SUSE-SU-2026:23374-1, SUSE-SU-2026:23034-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_19 +1 5-1.1 SUSE-SU-2026:23375-1, SUSE-SU-2026:23366-1, SUSE-SU-2026:23033-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_20 +4 4-1.1 SUSE-SU-2026:23484-1, SUSE-SU-2026:23483-1, SUSE-SU-2026:23378-1
SLE Micro 6.0 kernel-livepatch-MICRO-6-0_Update_9 21-1.2 SUSE-SU-2026:23025-1
SLE Live Patching 15 SP7 kernel-default 6.4.0-150700.53.55.1 SUSE-SU-2026:2238-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7-RT_Update_12 7-150700.2.1 SUSE-SU-2026:3746-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_10 +2 8-150700.2.1 SUSE-SU-2026:3771-1, SUSE-SU-2026:3770-1, SUSE-SU-2026:3696-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_12 +1 6-150700.2.1 SUSE-SU-2026:3698-1, SUSE-SU-2026:3264-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_14 +1 4-150700.2.1 SUSE-SU-2026:3774-1, SUSE-SU-2026:3694-1, SUSE-SU-2026:3256-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_15 1-150700.15.3.1 SUSE-SU-2026:2238-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_3 15-150700.2.1 SUSE-SU-2026:3726-1, SUSE-SU-2026:3321-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_4 +1 16-150700.2.1 SUSE-SU-2026:3754-1, SUSE-SU-2026:3689-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_5 12-150700.2.1 SUSE-SU-2026:3316-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_6 10-150700.2.1 SUSE-SU-2026:3704-1, SUSE-SU-2026:3343-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_7 +3 11-150700.2.1 SUSE-SU-2026:3768-1, SUSE-SU-2026:3761-1, SUSE-SU-2026:3748-1
SLE Live Patching 15 SP7 kernel-livepatch-SLE15-SP7_Update_9 9-150700.2.1 SUSE-SU-2026:3286-1
SLE Live Patching 15 SP6 kernel-default 6.4.0-150600.23.112.1 SUSE-SU-2026:2195-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_14 +1 16-150600.2.1 SUSE-SU-2026:3754-1, SUSE-SU-2026:3726-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_16 13-150600.2.1 SUSE-SU-2026:3704-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_18 +2 10-150600.2.1 SUSE-SU-2026:3748-1, SUSE-SU-2026:3719-1, SUSE-SU-2026:3316-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_24 6-150600.2.1 SUSE-SU-2026:3761-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_25 4-150600.2.1 SUSE-SU-2026:3760-1, SUSE-SU-2026:3254-1
SLE Live Patching 15 SP6 kernel-livepatch-SLE15-SP6_Update_26 1-150600.13.3.1 SUSE-SU-2026:2195-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_28 21-150500.2.1 SUSE-SU-2026:3289-1
SLE Live Patching 15 SP5 kernel-livepatch-SLE15-SP5_Update_38 6-150500.2.1 SUSE-SU-2026:3319-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_50 7-150400.2.1 SUSE-SU-2026:3345-1
SLE Live Patching 15 SP4 kernel-livepatch-SLE15-SP4_Update_51 6-150400.2.1 SUSE-SU-2026:3354-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 6.19.8-1.1 openSUSE-SU-2026:10387-1
openSUSE Leap 16.0 kernel-default-base 6.12.0-160000.27.1.160000.2.8 openSUSE-SU-2026:20572-1
openSUSE Leap 16.0 kernel-rt +11 6.12.0-160000.28.1 openSUSE-SU-2026:20572-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 kernel-livepatch-6.12.77-99.140 +1 1:1.0-0.amzn2023 ALAS2023-2026-1702, ALAS2023-2026-1543, ALAS2023-2026-1515
Amazon Linux 2023 perf6.12 +14 1:6.12.77-99.140.amzn2023 ALAS2023-2026-1543
Amazon Linux 2023 perf6.18 +14 1:6.18.16-18.222.amzn2023 ALAS2023-2026-1702, ALAS2023-2026-1515

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel No fix yet —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-202.76.4.1.el10uek ELSA-2026-50372, ELSA-2026-50260

Advisories 50

References