CVE-2026-23372

Vulnerability

In the Linux kernel's NFC subsystem, the rawsock socket implementation lacks proper synchronization between the rawsock_tx_work workqueue task and the socket release path. When a process is killed (e.g., by SIGKILL), rawsock_release() can run concurrently with rawsock_tx_work, which calls nfc_data_exchange and dereferences the NCI device. Without a lock or flag, this race can result in a use-after-free or leaked references [1][2][3][4].

Exploitation

The vulnerability is triggered by terminating a process that holds an NFC rawsock while it has pending transmit work. No special privilege is required beyond the ability to open a raw NFC socket; the attacker must trigger the race condition, but a remote attacker cannot directly exploit it unless they can cause a process to exit abruptly. The attack surface is limited to local users with access to NFC sockets.

Impact

A successful exploit allows an attacker to corrupt kernel memory, leading to a system crash (denial of service) or potentially arbitrary code execution in kernel context. The CVSS v3 base score is 7.8 (High), indicating a locally exploitable vulnerability with high impact on confidentiality, integrity, and availability.

Mitigation

The fix introduces a SEND_SHUTDOWN flag set before any teardown so that if tx_work is already running, it will see the flag and abort transmission. It then uses cancel_work_sync to wait for any in-progress execution and purges the write queue. This patch has been applied to the stable kernel tree [1][2][3][4]; users should update to a corrected version.