High 7.8Published Jun 3, 2026

CVE-2026-46267nfc: hci: shdlc: Stop timers and work before freeing context

Updated under an hour ago (Oct 27, 2026, 8:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: shdlc: Stop timers and work before freeing context llc_shdlc_deinit() purges SHDLC skb queues and frees the llc_shdlc structure while its timers and state machine work may still be active. Timer callbacks can schedule sm_work, and sm_work accesses SHDLC state and the skb queues. If teardown happens in parallel with a queued/running work item, it can lead to UAF and other shutdown races. Stop all SHDLC timers and cancel sm_work synchronously before purging the queues and freeing the context. Found by Linux Verification Center (linuxtesting.org) with SVACE.

CVSS: 7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 3, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 4a61cd6687fc6348d08724676d34e38160d6cf9b before c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e; from 4a61cd6687fc6348d08724676d34e38160d6cf9b before a24a676329d40481b2331bfa1418a679577dfd3a; from 4a61cd6687fc6348d08724676d34e38160d6cf9b before 77eef9f2eef045c3c37a3df82d3e661afb866b98; from 4a61cd6687fc6348d08724676d34e38160d6cf9b before cf70cedce327833296ebe6043364d1e44b76a2ab; from 4a61cd6687fc6348d08724676d34e38160d6cf9b before 276820278e9717cc7d4bb32381892dd3ddf418d4; 4a61cd6687fc6348d08724676d34e38160d6cf9b builds before 1cb97b1225450af3f7b728777929ba50c6a58ced; from 4a61cd6687fc6348d08724676d34e38160d6cf9b before c9efde1e537baed7648a94022b43836a348a074f	CNA record
linux linux_kernel linux:linux_kernel	from 3.7 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4	NVD

References

References

https://git.kernel.org/stable/c/c60f41022eaad2a1dafecd3ae6f249a3bd6d4b6e	patch
https://git.kernel.org/stable/c/a24a676329d40481b2331bfa1418a679577dfd3a	patch
https://git.kernel.org/stable/c/77eef9f2eef045c3c37a3df82d3e661afb866b98	patch
https://git.kernel.org/stable/c/cf70cedce327833296ebe6043364d1e44b76a2ab	patch
https://git.kernel.org/stable/c/276820278e9717cc7d4bb32381892dd3ddf418d4	patch
https://git.kernel.org/stable/c/1cb97b1225450af3f7b728777929ba50c6a58ced	patch
https://git.kernel.org/stable/c/c9efde1e537baed7648a94022b43836a348a074f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.