Cloudanix VulnDB

CVE-2026-23372

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Mar 25, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A problem in the Linux kernel's handling of wireless NFC connections can let a local user crash the system or take it over by abruptly ending a program.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in rawsock_release allows tx_work on the system workqueue to call nfc_data_exchange and dereference a freed NCI device after socket or device teardown, resulting in use-after-free or leaked references when a process exits abruptly.

Why it matters to the business

Local attackers on Linux systems using NFC can trigger kernel memory corruption, leading to crashes, data leaks, or full system compromise; 215 days have passed since publication with no fixed versions listed, increasing exposure across the ecosystem.

How an attack unfolds

An attacker with local access creates an NFC raw socket, triggers abrupt process termination (e.g., via SIGKILL), and relies on the unsynchronized tx_work to race with socket teardown and access freed memory; no named threat actors are associated.

How to fix it

Apply the upstream fix that sets SEND_SHUTDOWN, calls cancel_work_sync on tx_work, and purges the write queue in rawsock_release before orphaning the socket; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Inspect the rawsock_release function in net/nfc/rawsock.c for the presence of send_shutdown flag setting followed by cancel_work_sync and skb purge; confirm via kernel build logs or runtime testing that tx_work no longer races with teardown.

Typical attack path

  1. Obtain local user access on an affected Linux kernel
  2. Create and use an NFC raw socket
  3. Force socket teardown via process kill or device removal
  4. Trigger tx_work execution to dereference freed NCI structures

How to detect it

Review kernel logs for oops/panic traces referencing nfc, rawsock, or nfc_data_exchange around process termination events; correlate with sudden socket closures or device removal on systems with NFC enabled.

What your security team should do

  • Immediately audit all Linux systems for NFC raw socket usage and kernel versions
  • Backport or apply the described synchronization patch if a fixed kernel is unavailable
  • Restrict local NFC access via module blacklisting or capability controls until patched
  • Monitor for kernel oops or panic reports involving nfc_data_exchange

The record

In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references. Set SEND_SHUTDOWN first so that if tx_work is already running it will see the flag and skip transmitting, then use cancel_work_sync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.

Affected packages

Ecosystem Package Introduced Fixed