CVE-2026-46267

nfc: hci: shdlc: Stop timers and work before freeing context

published June 3, 2026

CVSS
—
EPSS
0%
Percentile
6.7
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc

structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state

and the skb queues. If teardown happens in parallel with a queued/running

work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm_work synchronously before purging the

queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00176 · 6.7th percentile
Published
2026-06-03T15:50Z
EPSS history
Timeline
  • 03 JUN 15:50Z
    nfc: hci: shdlc: Stop timers and work before freeing context
    cvelistv5