# CVE-2026-23240: Linux Kernel race condition in tls_sw_cancel_work_tx

Source: https://junglewise.ai/threats/cve-2026-23240-linux-kernel-race-condition-in-tls-sw-cancel-work-tx  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-10. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2026-23240 · Severity: critical · CVSS 9.8 · Published 2026-03-10

A vulnerability exists in the Linux kernel's Transport Layer Security (TLS) implementation. The TLS component is responsible for encrypting data sent over a network to ensure privacy and security. An exploit could allow an attacker to cause a system crash or potentially execute unauthorized actions by triggering a race condition that accesses memory after it has been freed, impacting the reliability and security of the server.

Technologies: [Linux Kernel](https://junglewise.ai/threats/technologies/kernel). Vendors: [Linux](https://junglewise.ai/threats/vendors/linux).

## Quick answers

**Is CVE-2026-23240 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-23240 being exploited in the wild.

**How severe is CVE-2026-23240?** Critical severity, with a CVSS score of 9.8, published 10 March 2026.

**Which products and versions are affected?** Linux Kernel versions from 5.3.1 up to 6.12.75, 6.13 up to 6.18.16, 6.19 up to 6.19.6.

**Is there a fix for CVE-2026-23240?** A patch was published on 2026-02-23: Fix committed to the Linux kernel tree Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-23240 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2026-23240?** Check whether you run Linux Kernel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in the Linux kernel TLS implementation within the tls_sw_cancel_work_tx() function. When a TLS socket is closed via tls_sk_proto_close(), the tx_work_handler() can still be rescheduled by other kernel paths like the Delayed ACK handler or ksoftirqd after cancel_delayed_work_sync() has been called. This results in a use-after-free scenario where the worker thread dereferences a TLS object that has already been freed. The vulnerability is addressed by replacing cancel_delayed_work_sync() with disable_delayed_work_sync() to ensure the work cannot be rescheduled during the closing process. This issue was identified as CWE-362.

## Affected products

- Linux Linux Kernel versions from 5.3.1 up to 6.12.75, 6.13 up to 6.18.16, 6.19 up to 6.19.6

## Timeline

- 2026-03-10: advisory: Initial disclosure and NVD publication
- 2026-02-23: patched: Fix committed to the Linux kernel tree

## References

- [https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b](https://git.kernel.org/stable/c/17153f154f80be2b47ebf52840f2d8f724eb2f3b)
- [https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4](https://git.kernel.org/stable/c/7bb09315f93dce6acc54bf59e5a95ba7365c2be4)
- [https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b](https://git.kernel.org/stable/c/854cd32bc74fe573353095e90958490e4e4d641b)
- [https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de](https://git.kernel.org/stable/c/a5de36d6cee74a92c1a21b260bc507e64bc451de)

## Related threats

- [Linux IOMMU page table logic error in arm_lpae_split_blk_unmap](https://junglewise.ai/threats/cve-2026-56934-in-arm-lpae-split-blk-unmap-of-drivers-iommu-io-pgtable-arm)
- [Linux kernel null pointer dereference in TCP established lookup](https://junglewise.ai/threats/cve-2026-99288-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel xen-netback race condition in XenBus disconnect](https://junglewise.ai/threats/cve-2026-99286-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel shared-frag flag loss in skb_zerocopy](https://junglewise.ai/threats/cve-2026-99284-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)
- [Linux kernel netfilter conntrack TCP RST timeout handling](https://junglewise.ai/threats/cve-2026-99283-in-the-linux-kernel-the-following-vulnerability-has-been-resolved)