Executive brief
A vulnerability was identified in the Linux kernel's Near Field Communication (NFC) component. During the shutdown process of certain NFC drivers, the system could attempt to use memory that has already been freed, potentially leading to a system crash or unpredictable behavior. This issue primarily affects the stability of devices using NFC hardware when the driver is being deactivated.
Technical details
A use-after-free (UAF) vulnerability exists in net/nfc/hci/llc_shdlc.c within the Linux kernel. The function llc_shdlc_deinit() was found to purge skb queues and free the llc_shdlc structure while timers (connect_timer, t1_timer, t2_timer) and the state machine work (sm_work) remained active. Because timer callbacks can reschedule sm_work, and sm_work accesses the SHDLC state and queues, a race condition occurs if teardown happens in parallel with running work items. The fix involves calling timer_shutdown_sync() and cancel_work_sync() before freeing the context to ensure all asynchronous operations are terminated.
Affected products
- Linux Linux Kernel Fixed in versions including 6.1, 6.6, 6.12, 6.13, and 7.0+
Timeline
- 2026-02-03: other: Patch submitted by developer
- 2026-02-26: patched: Commits merged into stable branches
- 2026-06-03: disclosed: CVE published to NVD
References
- https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced
- https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4
- https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98
- https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a
- https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e
- https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f
- https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab