Use-After-Free Vulnerability in Linux Kernel's NFC Functionality

CVE-2026-64011

What is CVE-2026-64011?

A use-after-free vulnerability has been identified in the NFC protocol implementation within the Linux kernel. The issue arises during the execution of the llcp_sock_release() function, which incorrectly handles the unlinking of sockets. Specifically, if a socket is still in a connecting state, it remains on the connecting list and may lead to potential exploit scenarios. This vulnerability has been addressed to ensure that the socket state is verified before unlinking, thereby enhancing the security of the NFC subsystem and mitigating risks associated with improper memory management.

References