CVE-2026-46267
Use-After-Free in Linux Kernel NFC HCI SHDLC
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Linux kernel's NFC HCI SHDLC component. The issue occurs because timers and work items related to the SHDLC state machine are not properly stopped before the context is freed. Specifically, the function llc_shdlc_deinit() frees the SHDLC structure and purges its queues while timers and state machine work may still be active. This can cause use-after-free (UAF) errors and race conditions during shutdown, as timer callbacks can schedule work that accesses freed memory.
The fix involves stopping all SHDLC timers and synchronously canceling the state machine work before purging the queues and freeing the context, preventing these unsafe accesses.
How can this vulnerability impact me? :
This vulnerability can lead to use-after-free conditions and race conditions in the Linux kernel NFC subsystem. Such issues may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause denial of service by exploiting the improper shutdown sequence of the SHDLC context.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability involves timers and work items in the Linux kernel NFC HCI SHDLC driver that may still be active during context freeing, leading to use-after-free and shutdown races.
To mitigate this vulnerability, ensure that all SHDLC timers are stopped and the sm_work is cancelled synchronously before purging the skb queues and freeing the context.
Practically, this means applying the patch or update that stops all SHDLC timers and cancels sm_work before freeing the context, as described in the fix.