From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-cve-announce@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@kernel.org>
Subject: CVE-2026-64010: nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
Date: Sun, 19 Jul 2026 16:57:50 +0200 [thread overview]
Message-ID: <2026071909-CVE-2026-64010-4f09@gregkh> (raw)
From: Greg Kroah-Hartman <gregkh@kernel.org>
Description
===========
In the Linux kernel, the following vulnerability has been resolved:
nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()
A race condition exists in the NFC LLCP connection state machine where
the connection acceptance packet (CC) can be processed concurrently with
socket release. This can lead to a use-after-free of the socket object.
When nfc_llcp_recv_cc() moves the socket from the connecting_sockets
list to the sockets list, it does so without holding the socket lock.
If llcp_sock_release() is executing concurrently, it might have already
unlinked the socket and dropped its references, which can result in
nfc_llcp_recv_cc() linking a freed socket into the live list.
Fix this by holding lock_sock() during the state transition and list
movement in nfc_llcp_recv_cc(). After acquiring the lock, check if
the socket is still hashed to ensure it hasn't already been unlinked
and marked for destruction by the release path. This aligns the locking
pattern with recv_hdlc() and recv_disc().
The Linux kernel CVE team has assigned CVE-2026-64010 to this issue.
Affected and fixed versions
===========================
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 5.10.259 with commit dce85215a6c7b0fd753f577a4c487f647119884c
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 5.15.210 with commit bd08bb7443c501d2f2a71d529e4afcf11c9b07d2
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 6.1.176 with commit 0b45c31746e1523d5d482fda8fcf54a35ac417f1
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 6.6.143 with commit ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 6.12.93 with commit ad8a27d63cac96bac441edd002209ebd996e12fb
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 6.18.35 with commit 650bdd8fdfab64a09ee474150313dbc48c374795
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 7.0.12 with commit b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183
Issue introduced in 3.6 with commit a69f32af86e389dd232b1bb2269e202c1bfcc60f and fixed in 7.1 with commit b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77
Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.
Unaffected versions might change over time as fixes are backported to
older supported kernel versions. The official CVE entry at
https://cve.org/CVERecord/?id=CVE-2026-64010
will be updated if fixes are backported, please check that for the most
up to date information about this issue.
Affected files
==============
The file(s) affected by this issue are:
net/nfc/llcp_core.c
Mitigation
==========
The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes. Individual
changes are never tested alone, but rather are part of a larger kernel
release. Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all. If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c
https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2
https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1
https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2
https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb
https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795
https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183
https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77
reply other threads:[~2026-07-19 15:03 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071909-CVE-2026-64010-4f09@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=cve@kernel.org \
--cc=gregkh@kernel.org \
--cc=linux-cve-announce@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.