Linux Kernel espintcp race in espintcp_close()
CVE-2026-23239 Published on March 10, 2026
espintcp: Fix race condition in espintcp_close()
In the Linux kernel, the following vulnerability has been resolved:
espintcp: Fix race condition in espintcp_close()
This issue was discovered during a code audit.
After cancel_work_sync() is called from espintcp_close(),
espintcp_tx_work() can still be scheduled from paths such as
the Delayed ACK handler or ksoftirqd.
As a result, the espintcp_tx_work() worker may dereference a
freed espintcp ctx or sk.
The following is a simple race scenario:
cpu0 cpu1
espintcp_close()
cancel_work_sync(&ctx->work);
espintcp_write_space()
schedule_work(&ctx->work);
To prevent this race condition, cancel_work_sync() is
replaced with disable_work_sync().
Products Associated with CVE-2026-23239
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 and below f7ad8b1d0e421c524604d5076b73232093490d5c is affected.
- Version e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 and below 664e9df53226b4505a0894817ecad2c610ab11d8 is affected.
- Version e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 and below 022ff7f347588de6e17879a1da6019647b21321b is affected.
- Version e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 and below e1512c1db9e8794d8d130addd2615ec27231d994 is affected.
- Version 5.6 is affected.
- Before 5.6 is unaffected.
- Version 6.12.75, <= 6.12.* is unaffected.
- Version 6.18.16, <= 6.18.* is unaffected.
- Version 6.19.6, <= 6.19.* is unaffected.
- Version 7.0-rc2, <= * is unaffected.