CVE-2026-23372 PUBLISHED

nfc: rawsock: cancel tx_work before socket teardown

Assigner: Linux
Reserved: 13.01.2026 Published: 25.03.2026 Updated: 25.03.2026

In the Linux kernel, the following vulnerability has been resolved:

nfc: rawsock: cancel tx_work before socket teardown

In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.

Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to 3ae592ed91bb4b6b51df256b51045c13d2656049 (excl.)
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to 722a28b635ec281bb08a23885223526d8e7d6526 (excl.)
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to 78141b8832e16d80d09cbefb4258612db0777a24 (excl.)
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to edc988613def90c5b558e025b1b423f48007be06 (excl.)
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to da4515fc8263c5933ed605e396af91079806dc45 (excl.)
  • affected from 23b7869c0fd08d73c9f83a2db88a13312d6198bb to d793458c45df2aed498d7f74145eab7ee22d25aa (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 3.1 is affected
  • unaffected from 0 to 3.1 (excl.)
  • unaffected from 6.1.167 to 6.1.* (incl.)
  • unaffected from 6.6.130 to 6.6.* (incl.)
  • unaffected from 6.12.77 to 6.12.* (incl.)
  • unaffected from 6.18.17 to 6.18.* (incl.)
  • unaffected from 6.19.7 to 6.19.* (incl.)
  • unaffected from 7.0-rc3 to * (incl.)

References