[SRU][Q/N/J][PATCH v2 0/3] CVE-2026-23240

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-23240

[ Impact ]

A race condition exists in the TLS socket layer's tls_sw_cancel_work_tx().
After cancel_delayed_work_sync() is called from tls_sk_proto_close(), the
tx_work_handler() worker can still be rescheduled from paths such as the
Delayed ACK handler or ksoftirqd. As a result, the worker may dereference a
freed TLS object, leading to a use-after-free. This can result in memory
corruption, denial of service, or potential privilege escalation.

[ Fix ]

noble: clean cherry-pick
jammy: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this fix would affect the kernel TLS (tls) subsystem,
potentially impacting socket teardown for TLS connections. If the conversion
from cancel_delayed_work_sync() to disable_delayed_work_sync() is incorrect, it
could lead to hangs during socket close or leave the tx work handler in an
unexpected state.