Out-of-Cancel: A Vulnerability Class Rooted in Workqueue Cancellation APIs

Hyunwoo Kim published an article describing a complicated exploit of a race condition caused by a misuse of the cancel_work_sync() kernel API in the network subsystem.

https://v4bel.github.io/linux/2026/03/23/ooc.html