{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64010","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.026Z","datePublished":"2026-07-19T14:56:25.162Z","dateUpdated":"2026-08-05T12:38:10.194Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:38:10.194Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) can be processed concurrently with\nsocket release.  This can lead to a use-after-free of the socket object.\n\nWhen nfc_llcp_recv_cc() moves the socket from the connecting_sockets\nlist to the sockets list, it does so without holding the socket lock.\nIf llcp_sock_release() is executing concurrently, it might have already\nunlinked the socket and dropped its references, which can result in\nnfc_llcp_recv_cc() linking a freed socket into the live list.\n\nFix this by holding lock_sock() during the state transition and list\nmovement in nfc_llcp_recv_cc().  After acquiring the lock, check if\nthe socket is still hashed to ensure it hasn't already been unlinked\nand marked for destruction by the release path.  This aligns the locking\npattern with recv_hdlc() and recv_disc()."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:A - The corrupting input is an NFC LLCP Connection Complete (CC) PDU delivered over the NFC radio from a nearby peer; per kernel CNA guidance, NFC/Bluetooth-class wireless reachability maps to Adjacent rather than Local or Network.\nAC:L - The attacker can control both sides of the race by concurrently calling connect()/close() on an LLCP socket while timing CC transmission from an adjacent NFC device, making exploitation depend only on attacker-controlled timing rather than victim state.\nPR:N - An adjacent attacker needs no privileges on the victim system—the kernel processes inbound NFC frames in kernel context; SOCK_STREAM LLCP sockets require no CAP_NET_RAW, so no elevated credentials are needed on either attack path.\nUI:N - Exploitation can be fully automated by a local or adjacent attacker scripting concurrent connect/close and CC injection without requiring any deliberate victim action beyond the device having NFC active and an LLCP session in progress.\nS:U - Impact is confined to kernel memory corruption and local privilege escalation within the same kernel security domain; there is no VM escape, IOMMU bypass, or other cross-authority boundary crossing.\nC:H - The use-after-free operates on a freed socket structure still referenced in kernel linked lists, enabling reads of stale heap contents and kernel pointer disclosure as part of UAF exploitation.\nI:H - The UAF re-links a freed socket into the live list and writes connection TLVs into freed memory via nfc_llcp_parse_connection_tlv(), providing a heap corruption primitive suitable for arbitrary write and code execution.\nA:H - Use-after-free of a socket object in the NFC receive path reliably causes kernel oops/panic or hang, and the freed-but-linked socket corrupts subsequent list walks causing system crash."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"],"versions":[{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"dce85215a6c7b0fd753f577a4c487f647119884c","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"bd08bb7443c501d2f2a71d529e4afcf11c9b07d2","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"0b45c31746e1523d5d482fda8fcf54a35ac417f1","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"ad8a27d63cac96bac441edd002209ebd996e12fb","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"650bdd8fdfab64a09ee474150313dbc48c374795","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183","status":"affected","versionType":"git"},{"version":"a69f32af86e389dd232b1bb2269e202c1bfcc60f","lessThan":"b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/nfc/llcp_core.c"],"versions":[{"version":"3.6","status":"affected"},{"version":"0","lessThan":"3.6","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.6","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c"},{"url":"https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2"},{"url":"https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1"},{"url":"https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2"},{"url":"https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb"},{"url":"https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795"},{"url":"https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183"},{"url":"https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77"}],"title":"nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()","x_generator":{"engine":"bippy-1.2.0"}}}}