CVE-2026-23372

In the Linux kernel, the following vulnerability has been resolved:

nfc: rawsock: cancel tx_work before socket teardown

In rawsockrelease(), cancel any pending txwork and purge the write queue before orphaning the socket. rawsocktxwork runs on the system workqueue and calls nfcdataexchange which dereferences the NCI device. Without synchronization, tx_work can race with socket and device teardown when a process is killed (e.g. by SIGKILL), leading to use-after-free or leaked references.

Set SENDSHUTDOWN first so that if txwork is already running it will see the flag and skip transmitting, then use cancelworksync to wait for any in-progress execution to finish, and finally purge any remaining queued skbs.