Home

Description

In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may dereference a freed espintcp ctx or sk. The following is a simple race scenario: cpu0 cpu1 espintcp_close() cancel_work_sync(&ctx->work); espintcp_write_space() schedule_work(&ctx->work); To prevent this race condition, cancel_work_sync() is replaced with disable_work_sync().

PUBLISHED Reserved 2026-01-13 | Published 2026-03-10 | Updated 2026-04-13 | Assigner Linux




HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 (git) before f7ad8b1d0e421c524604d5076b73232093490d5c
affected

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 (git) before 664e9df53226b4505a0894817ecad2c610ab11d8
affected

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 (git) before 022ff7f347588de6e17879a1da6019647b21321b
affected

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 (git) before e1512c1db9e8794d8d130addd2615ec27231d994
affected

Default status
affected

5.6
affected

Any version before 5.6
unaffected

6.12.75 (semver)
unaffected

6.18.16 (semver)
unaffected

6.19.6 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/f7ad8b1d0e421c524604d5076b73232093490d5c

git.kernel.org/...c/664e9df53226b4505a0894817ecad2c610ab11d8

git.kernel.org/...c/022ff7f347588de6e17879a1da6019647b21321b

git.kernel.org/...c/e1512c1db9e8794d8d130addd2615ec27231d994

cve.org (CVE-2026-23239)

nvd.nist.gov (CVE-2026-23239)

Download JSON