ACK: [SRU][Q][PATCH 0/1] CVE-2026-23240

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 11:48, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-23240
>
> [ Impact ]
>
> A race condition exists in the TLS socket layer's tls_sw_cancel_work_tx().
> After cancel_delayed_work_sync() is called from tls_sk_proto_close(), the
> tx_work_handler() worker can still be scheduled from paths such as the Delayed
> ACK handler or ksoftirqd. As a result, the worker may dereference a freed TLS
> object, leading to a use-after-free that can cause memory corruption or be
> leveraged for privilege escalation.
>
> [ Fix ]
>
> questing: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression would manifest in the kernel TLS (net/tls) subsystem, potentially
> affecting socket teardown or transmit work scheduling for TLS connections. If
> the fix were incorrect, it could introduce hangs during socket close or fail to
> fully close the race window, leaving the use-after-free reachable.
>