Executive brief
A vulnerability exists in the Linux kernel's Near Field Communication (NFC) component. An attacker within physical proximity of a device could potentially trigger a system crash or execute unauthorized code by sending specially crafted NFC signals. This could lead to a complete loss of device availability or the exposure of sensitive data stored on the system.
Technical details
A use-after-free vulnerability exists in the Linux kernel NFC LLCP implementation due to missing return statements in nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(). When a socket is in the LLCP_CLOSED state, the code performs cleanup but fails to exit, leading to a fall-through that triggers a double release_sock() and a reference count underflow via a second nfc_llcp_sock_put(). This flaw can be triggered by an adjacent attacker via the NFC protocol. Patches have been released across multiple stable kernel branches to add the missing return statements.
Affected products
- Linux Linux Kernel 3.3 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-08: other: Patch authored
- 2026-04-24: disclosed: Initial disclosure from kernel.org
- 2026-04-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf
- https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c
- https://git.kernel.org/stable/c/665315df9c3486cb213fc44d83cc8bcd47fe0d26
- https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2
- https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf
- https://git.kernel.org/stable/c/9b49e2a4b8219a2fc5cebf94f4ec34e509aff8a6
- https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6