CVE-2026-23239 - espintcp: Fix race condition in espintcp_close()

Back Back to CVE browser

HIGH

espintcp: Fix race condition in espintcp_close()

Published Mar 10, 2026

7.8

HIGH

CVSS 3.1

EPSS 0.10%

Description

This issue was discovered during a code audit.

After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may dereference a freed espintcp ctx or sk.

The following is a simple race scenario:

cpu0 cpu1

espintcp_close() cancel_work_sync(&ctx->work); espintcp_write_space() schedule_work(&ctx->work);

To prevent this race condition, cancel_work_sync() is replaced with disable_work_sync().

Affected products

Vendor Linux Product Linux Default
unaffected
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
- Version
  
  Status
  affected
  Constraints
Vendor Linux Product Linux Default
affected
- Version
  5.6
  Status
  affected
  Constraints
  -
- Version
  0
  Status
  unaffected
  Constraints
  <5.6
- Version
  6.12.75
  Status
  unaffected
  Constraints
  <=6.12.*
- Version
  6.18.16
  Status
  unaffected
  Constraints
  <=6.18.*
- Version
  6.19.6
  Status
  unaffected
  Constraints
  <=6.19.*
- Version
  7.0
  Status
  unaffected
  Constraints
  <=*

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Linux

unaffected

Version	Status	Constraints
	affected
	affected
	affected
	affected

Linux

affected

Version	Status	Constraints
5.6	affected	-
0	unaffected	<5.6
6.12.75	unaffected	<=6.12.*
6.18.16	unaffected	<=6.18.*
6.19.6	unaffected	<=6.19.*
7.0	unaffected	<=*

Red Hat Enterprise Linux 10

kernel

Affected
Red Hat Enterprise Linux 6

kernel

Not affected
Red Hat Enterprise Linux 7

kernel

Not affected
Red Hat Enterprise Linux 7

kernel-rt

Not affected
Red Hat Enterprise Linux 8

kernel

Fix deferred
Red Hat Enterprise Linux 8

kernel-rt

Fix deferred
Red Hat Enterprise Linux 9

kernel

Affected
Red Hat Enterprise Linux 9

kernel-rt

Will not fix

Product	Package	State	Advisory
Red Hat Enterprise Linux 10	kernel	Affected	n/a
Red Hat Enterprise Linux 6	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel	Not affected	n/a
Red Hat Enterprise Linux 7	kernel-rt	Not affected	n/a
Red Hat Enterprise Linux 8	kernel	Fix deferred	n/a
Red Hat Enterprise Linux 8	kernel-rt	Fix deferred	n/a
Red Hat Enterprise Linux 9	kernel	Affected	n/a
Red Hat Enterprise Linux 9	kernel-rt	Will not fix	n/a

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-362

Race Condition

CWE-366

References (10)

Link	Providers	Tags
https://access.redhat.com/security/cve/CVE-2026-23239		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2446109		Issue Tracking
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-10573		Advisory
https://git.kernel.org/stable/c/022ff7f347588de6e17879a1da6019647b21321b		Patch
https://git.kernel.org/stable/c/664e9df53226b4505a0894817ecad2c610ab11d8		Patch
https://git.kernel.org/stable/c/e1512c1db9e8794d8d130addd2615ec27231d994		Patch
https://git.kernel.org/stable/c/f7ad8b1d0e421c524604d5076b73232093490d5c		Patch
https://lore.kernel.org/linux-cve-announce/2026031031-CVE-2026-23239-1fc9@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23239
https://www.cve.org/CVERecord?id=CVE-2026-23239