VulnSocial

CVE-2026-23240Disclosure(linux / linux_kernel)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit. After cancel_delayed_work_sync() is called from tls_sk_proto_close(), tx_work_handler() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the tx_work_handler() worker may dereference a freed TLS object. The following is a simple race scenario: cpu0 cpu1 tls_sk_proto_close() tls_sw_cancel_work_tx() tls_write_space() tls_sw_write_space() if (!test_and_set_bit(BIT_TX_SCHEDULED, &tx_ctx->tx_bitmask)) set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask); cancel_delayed_work_sync(&ctx->tx_work.work); schedule_delayed_work(&tx_ctx->tx_work.work, 0); To prevent this race condition, cancel_delayed_work_sync() is replaced with disable_delayed_work_sync().

linux CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-362

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • linux_kernel

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-03-16); latest day: 1
  • 2 total mentions across 2 days

Affected systems

Vendors
linux
Products
linux_kernel

2 versions affected across 1 product

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-03-16: 1Mentions · 2026-04-02: 1Technical Details · 2026-03-16: 1Technical Details · 2026-04-02: 103-1604-02
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • 0day Signal@0dayPublishing
    Disclosure

    🚨 CVE-2026-23240: tls: Fix race condition in tls_s... Race condition in Linux TLS allows freed object dereference via delayed work scheduling - textbook UAF with network rea... https://zerodaysignal.com/vulnerability/CVE-2026-23240 #netsec #vulnerability #CVE #sysadmin #zeroday

    Post summary

    The tweet announces a race condition in Linux TLS leading to a use‑after‑free (UAF) vulnerability, providing brief technical details but no PoC, exploit code, patch, or evidence of active exploitation.

    0000059
    194 followersView on X
  • CVE@CVEnew
    Disclosure

    CVE-2026-23240 In the Linux kernel, the following vulnerability has been resolved: tls: Fix race condition in tls_sw_cancel_work_tx() This issue was discovered during a code audit… https://www.cve.org/CVERecord?id=CVE-2026-23240

    Post summary

    The text reports that CVE‑2026‑23240, a race condition in the Linux kernel’s TLS implementation, has been identified and resolved through a fix.

    00000168
    56.7K followersView on X
CPE platform detail8 entries

8 of 8 entries

PartVendorProductVersionTarget SWTarget HW
OSlinuxlinux_kernel---
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel5.3--
OSlinuxlinux_kernel7.0--

Explore more

Back to dashboardlinux CVEslinux_kernel vulnerabilities