{"id":"CVE-2026-64010","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) c…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) c…","severity":"high","cvss":8.8,"cvssVector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-362","CWE-416"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 3.6, < 5.10.259","linux_kernel >= 5.11, < 5.15.210","linux_kernel >= 5.16, < 6.1.176","linux_kernel >= 6.2, < 6.6.143","linux_kernel >= 6.7, < 6.12.93","linux_kernel >= 6.13, < 6.18.35","linux_kernel >= 6.19, < 7.0.12","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.12"],"published":"2026-07-19","updated":"2026-10-13","sourceUpdated":"2026-10-13T13:57:35.497","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64010","references":[{"url":"https://git.kernel.org/stable/c/0b45c31746e1523d5d482fda8fcf54a35ac417f1","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/650bdd8fdfab64a09ee474150313dbc48c374795","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ad8a27d63cac96bac441edd002209ebd996e12fb","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b2a60f7f846faaf5c2cdad4ea6d3a33e5f863183","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/b493ea2765cc17cb8aa7e7544a4b6dcb05b6ed77","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/bd08bb7443c501d2f2a71d529e4afcf11c9b07d2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dce85215a6c7b0fd753f577a4c487f647119884c","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/ee2d1a8a1833c5e56e9a1745e64b0b4edda732c2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd"],"epss":0.00255,"epssPercentile":0.15831,"ingestedAt":"2026-10-13T14:29:01.774Z","slug":"CVE-2026-64010","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()\n\nA race condition exists in the NFC LLCP connection state machine where\nthe connection acceptance packet (CC) can be processed concurrently with\nsocket release.  This can lead to a use-after-free of the socket object.\n\nWhen nfc_llcp_recv_cc() moves the socket from the connecting_sockets\nlist to the sockets list, it does so without holding the socket lock.\nIf llcp_sock_release() is executing concurrently, it might have already\nunlinked the socket and dropped its references, which can result in\nnfc_llcp_recv_cc() linking a freed socket into the live list.\n\nFix this by holding lock_sock() during the state transition and list\nmovement in nfc_llcp_recv_cc().  After acquiring the lock, check if\nthe socket is still hashed to ensure it hasn't already been unlinked\nand marked for destruction by the release path.  This aligns the locking\npattern with recv_hdlc() and recv_disc().\n\n## Affected\n\n- `linux_kernel >= 3.6, < 5.10.259`\n- `linux_kernel >= 5.11, < 5.15.210`\n- `linux_kernel >= 5.16, < 6.1.176`\n- `linux_kernel >= 6.2, < 6.6.143`\n- `linux_kernel >= 6.7, < 6.12.93`\n- `linux_kernel >= 6.13, < 6.18.35`\n- `linux_kernel >= 6.19, < 7.0.12`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.12`","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":48.4,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}