CVE-2026-31509: nfc: nci: fix circular locking dependency in nci_close_device
In the Linux kernel, the following vulnerability has been resolved:
nfc: nci: fix circular locking dependency in nciclosedevice
nciclosedevice() flushes rxwq and txwq while holding reqlock. This causes a circular locking dependency because ncirxwork() running on rxwq can end up taking reqlock too:
ncirxwork -> ncirxdatapacket -> ncidataexchangecomplete -> skdestruct -> rawsockdestruct -> nfcdeactivatetarget -> ncideactivatetarget -> ncirequest -> mutexlock(&ndev->reqlock)
Move the flush of rxwq after reqlock has been released. This should safe (I think) because NCIUP has already been cleared and the transport is closed, so the work will see it and return -ENETDOWN.
NIPA has been hitting this running the nci selftest with a debug kernel on roughly 4% of the runs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31509?
CVE-2026-31509 is classified as a medium severity vulnerability due to its potential impact on the Linux kernel's nfc subsystem.
How do I fix CVE-2026-31509?
To mitigate CVE-2026-31509, update the Linux kernel to a patched version where the circular locking dependency has been resolved.
What systems are affected by CVE-2026-31509?
CVE-2026-31509 affects certain versions of the Linux kernel that implement the NFC subsystem functionality.
What is the main issue caused by CVE-2026-31509?
The main issue with CVE-2026-31509 is a circular locking dependency in the nci_close_device function, which could lead to deadlocks.
Which component of the Linux kernel is affected by CVE-2026-31509?
CVE-2026-31509 specifically affects the NFC (Near Field Communication) component of the Linux kernel.