Out-of-Cancel: A New Linux Kernel Race Condition Bug Class

Original text by v4bel

The article introduces a newly identified Linux kernel vulnerability pattern called “Out-of-Cancel”, which arises from incorrect assumptions about the behavior of workqueue cancellation APIs. The author analyzes how functions such as cancel_work_sync() or cancel_delayed_work_sync() are often used in kernel teardown paths to stop asynchronous work before freeing an object. However, these…

https://core-jmp.org/2026/03/out-of-cancel-a-new-linux-kernel-race-condition-bug-class/