CVE-2026-46267
Analyzed Analyzed - Analysis Complete
Use-After-Free in Linux Kernel NFC HCI SHDLC

Publication date: 2026-06-03

Last updated on: 2026-06-09

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races. Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context. Found by Linux Verification Center (linuxtesting.org) with SVACE.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-03
Last Modified
2026-06-09
Generated
2026-06-24
AI Q&A
2026-06-03
EPSS Evaluated
2026-06-22
NVD
CVE-2026-46267
EUVD
EUVD-2026-34129
Affected Vendors & Products
Showing 6 associated CPEs
Vendor Product Version / Range
linux linux_kernel From 6.13 (inc) to 6.18.14 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.4 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.128 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.75 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.165 (exc)
linux linux_kernel From 3.7 (inc) to 5.15.202 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's NFC HCI SHDLC component. The issue occurs because timers and work items related to the SHDLC state machine are not properly stopped before the context is freed. Specifically, the function llc_shdlc_deinit() frees the SHDLC structure and purges its queues while timers and state machine work may still be active. This can cause use-after-free (UAF) errors and race conditions during shutdown, as timer callbacks can schedule work that accesses freed memory.

The fix involves stopping all SHDLC timers and synchronously canceling the state machine work before purging the queues and freeing the context, preventing these unsafe accesses.

Impact Analysis

This vulnerability can lead to use-after-free conditions and race conditions in the Linux kernel NFC subsystem. Such issues may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the improper shutdown sequence of the SHDLC context.

Mitigation Strategies

The vulnerability involves timers and work items in the Linux kernel NFC HCI SHDLC driver that may still be active during context freeing, leading to use-after-free and shutdown races.

To mitigate this vulnerability, ensure that all SHDLC timers are stopped and the sm_work is cancelled synchronously before purging the skb queues and freeing the context.

Practically, this means applying the patch or update that stops all SHDLC timers and cancels sm_work before freeing the context, as described in the fix.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-46267. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart