{"id":"CVE-2026-64010","state":"PUBLISHED","title":"nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) can be processed concurrently with\nsocket release.  This can lead to a use-after-free of the socket object.\n\nWhen nfc_llcp_recv_cc() moves the socket from the connecting_sockets\nlist to the sockets list, it does so without holding the socket lock.\nIf llcp_sock_release() is executing concurrently, it might have already\nunlinked the socket and dropped its references, which can result in\nnfc_llcp_recv_cc() linking a freed socket into the live list.\n\nFix this by holding lock_sock() during the state transition and list\nmovement in nfc_llcp_recv_cc().  After acquiring the lock, check if\nthe socket is still hashed to ensure it hasn't already been unlinked\nand marked for destruction by the release path.  This aligns the locking\npattern with recv_hdlc() and recv_disc().","publishedAt":"2026-07-19T14:56:25.162Z","updatedAt":"2026-08-05T12:38:10.194Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"dce85215a6c7b0fd753f577a4c487f647119884c","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"bd08bb7443c501d2f2a71d529e4afcf11c9b07d2","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"0b45c31746e1523d5d482fda8fcf54a35ac417f1","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"ad8a27d63cac96bac441edd002209ebd996e12fb","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"650bdd8fdfab64a09ee474150313dbc48c374795","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"]}],"references":["https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c","https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2","https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1","https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2","https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb","https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795","https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183","https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64010.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64010","state":"PUBLISHED","datePublished":"2026-07-19T14:56:25.162Z","dateUpdated":"2026-08-05T12:38:10.194Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.026Z"},"containers":{"cna":{"title":"nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) can be processed concurrently with\nsocket release.  This can lead to a use-after-free of the socket object.\n\nWhen nfc_llcp_recv_cc() moves the socket from the connecting_sockets\nlist to the sockets list, it does so without holding the socket lock.\nIf llcp_sock_release() is executing concurrently, it might have already\nunlinked the socket and dropped its references, which can result in\nnfc_llcp_recv_cc() linking a freed socket into the live list.\n\nFix this by holding lock_sock() during the state transition and list\nmovement in nfc_llcp_recv_cc().  After acquiring the lock, check if\nthe socket is still hashed to ensure it hasn't already been unlinked\nand marked for destruction by the release path.  This aligns the locking\npattern with recv_hdlc() and recv_disc()."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"dce85215a6c7b0fd753f577a4c487f647119884c","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"bd08bb7443c501d2f2a71d529e4afcf11c9b07d2","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"0b45c31746e1523d5d482fda8fcf54a35ac417f1","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"ad8a27d63cac96bac441edd002209ebd996e12fb","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"650bdd8fdfab64a09ee474150313dbc48c374795","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","status":"affected","lessThan":"b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"3.6","status":"affected"},{"version":"0","status":"unaffected","lessThan":"3.6","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c"},{"url":"https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2"},{"url":"https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1"},{"url":"https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2"},{"url":"https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb"},{"url":"https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795"},{"url":"https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183"},{"url":"https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The corrupting input is an NFC LLCP Connection Complete (CC) PDU delivered over the NFC radio from a nearby peer; per kernel CNA guidance, NFC/Bluetooth-class wireless reachability maps to Adjacent rather than Local or Network.\nAC:L - The attacker can control both sides of the race by concurrently calling connect()/close() on an LLCP socket while timing CC transmission from an adjacent NFC device, making exploitation depend only on attacker-controlled timing rather than victim state.\nPR:N - An adjacent attacker needs no privileges on the victim system—the kernel processes inbound NFC frames in kernel context; SOCK_STREAM LLCP sockets require no CAP_NET_RAW, so no elevated credentials are needed on either attack path.\nUI:N - Exploitation can be fully automated by a local or adjacent attacker scripting concurrent connect/close and CC injection without requiring any deliberate victim action beyond the device having NFC active and an LLCP session in progress.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security domain; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - The use-after-free operates on a freed socket structure still referenced in kernel linked lists, enabling reads of stale heap contents and kernel pointer disclosure as part of UAF exploitation.\nI:H - The UAF re-links a freed socket into the live list and writes connection TLVs into freed memory via nfc_llcp_parse_connection_tlv(), providing a heap corruption primitive suitable for arbitrary write and code execution.\nA:H - Use-after-free of a socket object in the NFC receive path reliably causes kernel oops/panic or hang, and the freed-but-linked socket corrupts subsequent list walks causing system crash."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:38:10.194Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}