CVE-2026-23372
nfc: rawsock: cancel tx_work before socket teardown
Description
In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.
INFO
Published Date :
March 25, 2026, 11:16 a.m.
Last Modified :
April 24, 2026, 4:36 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Set SEND_SHUTDOWN flag.
- Cancel pending work synchronously.
- Purge remaining queued skbs.
- Apply the Linux kernel patch.
Public PoC/Exploit Available at Github
CVE-2026-23372 has a 1 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-23372.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-23372 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-23372
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
DSA and DLA for Debian last 14 days
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-23372 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-23372 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Apr. 24, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:3.1:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.7 *cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.17 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.130 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.77 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.203 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.167 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.1.1 up to (excluding) 5.10.253 Added Reference Type kernel.org: https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 18, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/9b2d23cd09e1cb56bdf0e4d5614703094159f16c Added Reference https://git.kernel.org/stable/c/cdeed45ce8c92defd057f7d67ee9a69374d8fa16 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 02, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Mar. 25, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs. Added Reference https://git.kernel.org/stable/c/3ae592ed91bb4b6b51df256b51045c13d2656049 Added Reference https://git.kernel.org/stable/c/722a28b635ec281bb08a23885223526d8e7d6526 Added Reference https://git.kernel.org/stable/c/78141b8832e16d80d09cbefb4258612db0777a24 Added Reference https://git.kernel.org/stable/c/d793458c45df2aed498d7f74145eab7ee22d25aa Added Reference https://git.kernel.org/stable/c/da4515fc8263c5933ed605e396af91079806dc45 Added Reference https://git.kernel.org/stable/c/edc988613def90c5b558e025b1b423f48007be06