CVE-2026-23239: espintcp: Fix race condition in espintcp_close()

Severity: high (CVSS 7.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-03-10 · updated 2026-10-19
Weakness: CWE-362

Description

In the Linux kernel, the following vulnerability has been resolved: espintcp: Fix race condition in espintcp_close() This issue was discovered during a code audit. After cancel_work_sync() is called from espintcp_close(), espintcp_tx_work() can still be scheduled from paths such as the Delayed ACK handler or ksoftirqd. As a result, the espintcp_tx_work() worker may dereference a freed espintcp ctx or sk. The following is a simple race scenario: cpu0 cpu1 espintcp_close() cancel_work_sync(&ctx->work); espintcp_write_space() schedule_work(&ctx->work); To prevent this race condition, cancel_work_sync() is replaced with disable_work_sync().

Affected products

Linux kernel: from 5.6 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 7.0-rc1 — fixed in 6.12.75, 6.18.16, 6.19.6

How to fix

Upgrade to a fixed version: Linux kernel 6.12.75, 6.18.16, 6.19.6. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-23239 or the next vulnerability affects your stack