NACK/Cmnt: [SRU][Q/N/J][PATCH v2 0/3] CVE-2026-23240

[Edoardo Canepa]

Rejected for the following reasons:

Missing questing patch which was included in v1 but not in v2.

On 6/23/26 23:51, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-23240
>
> [ Impact ]
>
> A race condition exists in the TLS socket layer's tls_sw_cancel_work_tx().
> After cancel_delayed_work_sync() is called from tls_sk_proto_close(), the
> tx_work_handler() worker can still be rescheduled from paths such as the
> Delayed ACK handler or ksoftirqd. As a result, the worker may dereference a
> freed TLS object, leading to a use-after-free. This can result in memory
> corruption, denial of service, or potential privilege escalation.
>
> [ Fix ]
>
> noble: clean cherry-pick
> jammy: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect the kernel TLS (tls) subsystem,
> potentially impacting socket teardown for TLS connections. If the conversion
> from cancel_delayed_work_sync() to disable_delayed_work_sync() is incorrect, it
> could lead to hangs during socket close or leave the tx work handler in an
> unexpected state.
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_0x20F88172E14F6784.asc
Type: application/pgp-keys
Size: 3167 bytes
Desc: OpenPGP public key
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/f6d0f833/attachment.key>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: OpenPGP_signature.asc
Type: application/pgp-signature
Size: 840 bytes
Desc: OpenPGP digital signature
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20260729/f6d0f833/attachment.sig>