{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31629","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-03-09T15:48:24.124Z","datePublished":"2026-04-24T14:42:49.849Z","dateUpdated":"2026-05-11T22:12:30.689Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T22:12:30.689Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: add missing return after LLCP_CLOSED checks\n\nIn nfc_llcp_recv_hdlc() and nfc_llcp_recv_disc(), when the socket\nstate is LLCP_CLOSED, the code correctly calls release_sock() and\nnfc_llcp_sock_put() but fails to return. Execution falls through to\nthe remainder of the function, which calls release_sock() and\nnfc_llcp_sock_put() again. This results in a double release_sock()\nand a refcount underflow via double nfc_llcp_sock_put(), leading to\na use-after-free.\n\nAdd the missing return statements after the LLCP_CLOSED branches\nin both functions to prevent the fall-through."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"],"versions":[{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"0eb1263a3b8c36418c9ba295c9ab3abed664edbf","status":"affected","versionType":"git"},{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"796e0cac058252d0ad34ebe288e6f7979b5fc9b2","status":"affected","versionType":"git"},{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"8977fad2b3c6eefd414131168d597c5d1d5e1abf","status":"affected","versionType":"git"},{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"ff3d9e8f7244293e303f7b6ef70774291c7c27e9","status":"affected","versionType":"git"},{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"aba4712e8f0381cd5d196534ce2ad082626a5ab6","status":"affected","versionType":"git"},{"version":"d646960f7986fefb460a2b062d5ccc8ccfeacc3a","lessThan":"2b5dd4632966c39da6ba74dbc8689b309065e82c","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"],"versions":[{"version":"3.3","status":"affected"},{"version":"0","lessThan":"3.3","status":"unaffected","versionType":"semver"},{"version":"6.6.136","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.83","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.24","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.14","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0.1","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1-rc1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"6.6.136"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"6.12.83"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"6.18.24"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"6.19.14"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"7.0.1"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.3","versionEndExcluding":"7.1-rc1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0eb1263a3b8c36418c9ba295c9ab3abed664edbf"},{"url":"https://git.kernel.org/stable/c/796e0cac058252d0ad34ebe288e6f7979b5fc9b2"},{"url":"https://git.kernel.org/stable/c/8977fad2b3c6eefd414131168d597c5d1d5e1abf"},{"url":"https://git.kernel.org/stable/c/ff3d9e8f7244293e303f7b6ef70774291c7c27e9"},{"url":"https://git.kernel.org/stable/c/aba4712e8f0381cd5d196534ce2ad082626a5ab6"},{"url":"https://git.kernel.org/stable/c/2b5dd4632966c39da6ba74dbc8689b309065e82c"}],"title":"nfc: llcp: add missing return after LLCP_CLOSED checks","x_generator":{"engine":"bippy-1.2.0"}}}}