[SRU][Q][PATCH 0/1] CVE-2026-23240

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-23240

[ Impact ]

A race condition exists in the TLS socket layer's tls_sw_cancel_work_tx().
After cancel_delayed_work_sync() is called from tls_sk_proto_close(), the
tx_work_handler() worker can still be scheduled from paths such as the Delayed
ACK handler or ksoftirqd. As a result, the worker may dereference a freed TLS
object, leading to a use-after-free that can cause memory corruption or be
leveraged for privilege escalation.

[ Fix ]

questing: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression would manifest in the kernel TLS (net/tls) subsystem, potentially
affecting socket teardown or transmit work scheduling for TLS connections. If
the fix were incorrect, it could introduce hangs during socket close or fail to
fully close the race window, leaving the use-after-free reachable.