PT-2026-46030 · Linux · Linux

Published 2026-06-03 · Updated 2026-06-03 · CVE-2026-46267

NVD

In the Linux kernel, the following vulnerability has been resolved:

nfc: hci: shdlc: Stop timers and work before freeing context

llc shdlc deinit() purges SHDLC skb queues and frees the llc shdlc structure while its timers and state machine work may still be active.

Timer callbacks can schedule sm work, and sm work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races.

Stop all SHDLC timers and cancel sm work synchronously before purging the queues and freeing the context.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Related Identifiers

CVE-2026-46267

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-46267 · Security Note
• https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab · Note
• https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced · Note
• https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e · Note
• https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4 · Note
• https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f · Note
• https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98 · Note
• https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a · Note