CVE-2026-46267

nfc: hci: shdlc: Stop timers and work before freeing context

State: Published
Severity: Not scored
Published: Jun 3, 2026
Updated: Jun 3, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4a61cd6687fc6348d08724676d34e38160d6cf9b to before c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6eAffected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before a24a676329d40481b2331bfa1418a679577dfd3aAffected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before 77eef9f2eef045c3c37a3df82d3e661afb866b98Affected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before cf70cedce327833296ebe6043364d1e44b76a2abAffected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before 276820278e9717cc7d4bb32381892dd3ddf418d4Affected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before 1cb97b1225450af3f7b728777929ba50c6a58cedAffected 4a61cd6687fc6348d08724676d34e38160d6cf9b to before c9efde1e537baed7648a94022b43836a348a074fAffected
LinuxLinux	3.7Affected before 3.7Not affected 5.15.202 through 5.15.Not affected 6.1.165 through 6.1.Not affected 6.6.128 through 6.6.Not affected 6.12.75 through 6.12.Not affected 6.18.14 through 6.18.Not affected 6.19.4 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

4a61cd6687fc6348d08724676d34e38160d6cf9b to before c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6eAffected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before a24a676329d40481b2331bfa1418a679577dfd3aAffected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before 77eef9f2eef045c3c37a3df82d3e661afb866b98Affected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before cf70cedce327833296ebe6043364d1e44b76a2abAffected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before 276820278e9717cc7d4bb32381892dd3ddf418d4Affected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before 1cb97b1225450af3f7b728777929ba50c6a58cedAffected
4a61cd6687fc6348d08724676d34e38160d6cf9b to before c9efde1e537baed7648a94022b43836a348a074fAffected

LinuxLinux

3.7Affected
before 3.7Not affected
5.15.202 through 5.15.*Not affected
6.1.165 through 6.1.*Not affected
6.6.128 through 6.6.*Not affected
6.12.75 through 6.12.*Not affected
6.18.14 through 6.18.*Not affected
6.19.4 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.