Linux Kernel Vulnerability in NFC LLCP Connection State Management

CVE-2026-64010

What is CVE-2026-64010?

A race condition in the NFC LLCP connection state machine allows a connection acceptance packet (CC) to be processed while the socket is being released. This concurrent execution can lead to a use-after-free scenario, where the nfc_llcp_recv_cc() function may link a released socket in the live list if proper locking protocols are not followed. The vulnerability arises as the socket is moved without holding the necessary socket lock, making it susceptible to concurrent modifications during its transition from connecting to active states. Proper resolution involves acquiring the lock before any state transition and checking that the socket remains valid throughout the process.

References