CVE-2026-23372: Linux Kernel Use-After-Free Vulnerability

CVE-2026-23372 Overview

CVE-2026-23372 is a use-after-free vulnerability in the Linux kernel's Near Field Communication (NFC) raw socket implementation. The flaw resides in rawsock_release(), where pending tx_work items are not cancelled before socket teardown. When a process holding an NFC raw socket is terminated, rawsock_tx_work running on the system workqueue can race with socket and device teardown. This race condition triggers use-after-free conditions or leaked references in the NFC Controller Interface (NCI) device structures. The vulnerability affects multiple Linux kernel versions and requires local access with low privileges to exploit.

Critical Impact
Local attackers can trigger use-after-free conditions in the Linux kernel by killing processes holding NFC raw sockets, potentially leading to privilege escalation or kernel memory corruption.

Affected Products

Linux Kernel (multiple stable branches prior to fixed commits)
Linux Kernel 3.1
Linux Kernel 7.0 release candidates (rc1 through rc7)

Discovery Timeline

2026-03-25 - CVE-2026-23372 published to NVD
2026-04-24 - Last updated in NVD database

Technical Details for CVE-2026-23372

Vulnerability Analysis

The vulnerability exists in the NFC raw socket subsystem within the Linux kernel's networking stack. The rawsock_release() function handles socket teardown when a process closes an NFC raw socket or terminates unexpectedly. Before this fix, the release path orphaned the socket without first cancelling pending asynchronous work.

The rawsock_tx_work handler executes on the kernel's shared system workqueue. This handler calls nfc_data_exchange(), which dereferences the underlying NCI device structure. When a process is killed by a signal such as SIGKILL while transmission work is queued or in progress, the work item can continue executing after the socket and associated device structures begin teardown.

Root Cause

The root cause is missing synchronization between socket release and pending workqueue items. The original rawsock_release() implementation did not invoke cancel_work_sync() on the tx_work structure before proceeding with teardown. As a result, tx_work could dereference freed memory belonging to the NCI device or socket, classified under [CWE-416] Use After Free.

Attack Vector

A local unprivileged user with access to NFC raw sockets can trigger the race by opening an NFC raw socket, queuing transmission work, and then forcing rapid termination of the process. Repeated exploitation attempts can reliably hit the race window between work execution and socket teardown. Successful exploitation may corrupt kernel memory, leak references, or potentially enable privilege escalation depending on the kernel allocator state.

The upstream fix sets SEND_SHUTDOWN first so that any running tx_work observes the flag and skips transmission. It then calls cancel_work_sync() to wait for in-progress execution to complete, and finally purges any remaining queued socket buffers (skbs) before the socket is orphaned. See the Kernel Git Commit edc9886 for the canonical patch.

Detection Methods for CVE-2026-23372

Indicators of Compromise

Unexpected kernel oops or panic messages referencing rawsock_tx_work, nfc_data_exchange, or NCI device structures in dmesg output.
KASAN (Kernel Address Sanitizer) reports indicating use-after-free in the NFC subsystem on kernels with debugging enabled.
Repeated short-lived processes opening NFC raw sockets followed by abnormal termination on devices with NFC hardware.

Detection Strategies

Monitor kernel logs for crash signatures involving net/nfc/rawsock.c and workqueue-related backtraces.
Audit socket(AF_NFC, SOCK_RAW, ...) system calls and correlate with subsequent process termination events.
Deploy kernel runtime integrity tooling that flags anomalous kernel memory access patterns.

Monitoring Recommendations

Enable auditd rules tracking NFC socket creation and unexpected SIGKILL delivery to processes holding such sockets.
Centralize kernel ring buffer logs to a SIEM and alert on oops or BUG signatures from the NFC subsystem.
Track kernel version inventory across Linux endpoints to identify systems running unpatched releases.

How to Mitigate CVE-2026-23372

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the vendor advisories as soon as your distribution publishes updated packages.
Identify systems with NFC hardware enabled and prioritize patching those endpoints first.
If patching is not immediately feasible, restrict local user access on affected systems and disable the nfc kernel module where it is not required.

Patch Information

The Linux kernel maintainers committed fixes across multiple stable branches. Reference commits include Kernel Git Commit 3ae592e, Kernel Git Commit 722a28b, Kernel Git Commit 78141b8, Kernel Git Commit 9b2d23c, Kernel Git Commit cdeed45, Kernel Git Commit d793458, Kernel Git Commit da4515f, and Kernel Git Commit edc9886.

Workarounds

Blacklist the nfc and nci kernel modules on systems that do not require NFC functionality.
Remove or restrict the CAP_NET_RAW capability for untrusted local users where feasible.
Use kernel module signing and lockdown features to prevent unauthorized loading of the NFC subsystem.

bash

# Configuration example: blacklist NFC modules until patches are applied
echo 'blacklist nfc' | sudo tee /etc/modprobe.d/blacklist-nfc.conf
echo 'blacklist nci' | sudo tee -a /etc/modprobe.d/blacklist-nfc.conf
sudo update-initramfs -u

# Verify the modules are not currently loaded
lsmod | grep -E 'nfc|nci'