CVE-2026-23372

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nfc: rawsock: cancel tx_work before socket teardown<br /> <br /> In rawsock_release(), cancel any pending tx_work and purge the write<br /> queue before orphaning the socket. rawsock_tx_work runs on the system<br /> workqueue and calls nfc_data_exchange which dereferences the NCI<br /> device. Without synchronization, tx_work can race with socket and<br /> device teardown when a process is killed (e.g. by SIGKILL), leading<br /> to use-after-free or leaked references.<br /> <br /> Set SEND_SHUTDOWN first so that if tx_work is already running it will<br /> see the flag and skip transmitting, then use cancel_work_sync to wait<br /> for any in-progress execution to finish, and finally purge any<br /> remaining queued skbs.