ACK: [SRU][Q/N/J][PATCH v2 0/3] CVE-2026-23240

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 05:51, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-23240
>
> [ Impact ]
>
> A race condition exists in the TLS socket layer's tls_sw_cancel_work_tx().
> After cancel_delayed_work_sync() is called from tls_sk_proto_close(), the
> tx_work_handler() worker can still be rescheduled from paths such as the
> Delayed ACK handler or ksoftirqd. As a result, the worker may dereference a
> freed TLS object, leading to a use-after-free. This can result in memory
> corruption, denial of service, or potential privilege escalation.
>
> [ Fix ]
>
> noble: clean cherry-pick
> jammy: clean cherry-pick
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this fix would affect the kernel TLS (tls) subsystem,
> potentially impacting socket teardown for TLS connections. If the conversion
> from cancel_delayed_work_sync() to disable_delayed_work_sync() is incorrect, it
> could lead to hangs during socket close or leave the tx work handler in an
> unexpected state.
>