Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23372— nfc: rawsock: cancel tx_work before socket teardown

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rawsock_release函数未取消待处理的tx_work，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.14% · P3

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 23b7869c0fd08d73c9f83a2db88a13312d6198bb< 9b2d23cd09e1cb56bdf0e4d5614703094159f16c affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< cdeed45ce8c92defd057f7d67ee9a69374d8fa16 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< 3ae592ed91bb4b6b51df256b51045c13d2656049 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< 722a28b635ec281bb08a23885223526d8e7d6526 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< 78141b8832e16d80d09cbefb4258612db0777a24 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< edc988613def90c5b558e025b1b423f48007be06 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< da4515fc8263c5933ed605e396af91079806dc45 affected
23b7869c0fd08d73c9f83a2db88a13312d6198bb< d793458c45df2aed498d7f74145eab7ee22d25aa affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23372

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
nfc: rawsock: cancel tx_work before socket teardown
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于rawsock_release函数未取消待处理的tx_work，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 23b7869c0fd08d73c9f83a2db88a13312d6198bb ~ 9b2d23cd09e1cb56bdf0e4d5614703094159f16c -
Linux Linux 3.1 -

II. Public POCs for CVE-2026-23372

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23372

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23372 (6)

Same Patch Batch · Linux · 2026-03-25 · 116 CVEs total

CVE-2026-23395 8.8 HIGH Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
CVE-2026-31788 8.2 HIGH xen/privcmd: restrict usage in unprivileged domU
CVE-2026-23340 7.8 HIGH net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
CVE-2026-23336 7.8 HIGH wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
CVE-2026-23350 7.8 HIGH drm/xe/queue: Call fini on exec queue creation fail
CVE-2026-23351 7.8 HIGH netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
CVE-2026-23317 7.8 HIGH drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
CVE-2026-23306 7.8 HIGH scsi: pm8001: Fix use-after-free in pm8001_queue_command()
CVE-2026-23378 7.8 HIGH net/sched: act_ife: Fix metalist update behavior
CVE-2026-23383 7.8 HIGH bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
CVE-2026-23288 7.8 HIGH accel/amdxdna: Fix out-of-bounds memset in command slot handling
CVE-2026-23391 7.8 HIGH netfilter: xt_CT: drop pending enqueued packets on template removal
CVE-2026-23280 7.8 HIGH accel/amdxdna: Prevent ubuf size overflow
CVE-2026-23392 7.8 HIGH netfilter: nf_tables: release flowtable after rcu grace period on error
CVE-2026-23393 7.8 HIGH bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23364 7.4 HIGH ksmbd: Compare MACs in constant time
CVE-2026-23294 7.0 HIGH bpf: Fix race in devmap on PREEMPT_RT
CVE-2026-23355 ata: libata: cancel pending work after clearing deferred_qc
CVE-2026-23359 bpf: Fix stack-out-of-bounds write in devmap
CVE-2026-23356 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

Showing top 20 of 116 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23372

No comments yet

Leave a comment