CVE-2026-23372

nfc: rawsock: cancel tx_work before socket teardown

State: Published
Severity: 7.8 High
Published: Mar 25, 2026
Updated: Oct 15, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: rawsock: cancel tx_work before socket teardown

In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.

Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 9b2d23cd09e1cb56bdf0e4d5614703094159f16cAffected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before cdeed45ce8c92defd057f7d67ee9a69374d8fa16Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 3ae592ed91bb4b6b51df256b51045c13d2656049Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 722a28b635ec281bb08a23885223526d8e7d6526Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 78141b8832e16d80d09cbefb4258612db0777a24Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before edc988613def90c5b558e025b1b423f48007be06Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before da4515fc8263c5933ed605e396af91079806dc45Affected 23b7869c0fd08d73c9f83a2db88a13312d6198bb to before d793458c45df2aed498d7f74145eab7ee22d25aaAffected
LinuxLinux	3.1Affected before 3.1Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.167 through 6.1.Not affected 6.6.130 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 9b2d23cd09e1cb56bdf0e4d5614703094159f16cAffected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before cdeed45ce8c92defd057f7d67ee9a69374d8fa16Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 3ae592ed91bb4b6b51df256b51045c13d2656049Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 722a28b635ec281bb08a23885223526d8e7d6526Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before 78141b8832e16d80d09cbefb4258612db0777a24Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before edc988613def90c5b558e025b1b423f48007be06Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before da4515fc8263c5933ed605e396af91079806dc45Affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb to before d793458c45df2aed498d7f74145eab7ee22d25aaAffected

LinuxLinux

3.1Affected
before 3.1Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.167 through 6.1.*Not affected
6.6.130 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.